ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt identifies network connections or host artifacts matching known indicators of compromise for the AsyncRAT remote access trojan, a tool frequently deployed by threat actors to establish persistent, low-noise control over compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to detect stealthy RAT deployments before they are leveraged for lateral movement or data exfiltration, reducing the dwell time of this high-severity threat.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 10 IOC Types: md5_hash, domain, sha1_hash, sha256_hash, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["185.242.3.250", "128.90.136.115"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["185.242.3.250", "128.90.136.115"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - AsyncRAT
let malicious_domains = dynamic(["qaqfaxian.com", "predatest.servebeer.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - AsyncRAT
let malicious_hashes = dynamic(["9522fead5e39391590927f75c4427cc7ebd2d02e", "1379414483df8390aa9eabf1e0d143b1", "747b8e6d1285ae88b1cf018515bf808ce00c25fc24e2231d95afabe6cbe1c1c7", "5da66e92ab3e6e9884729d835caf33b0b890aaec", "944d1a7459e616f7acb2077d930b665c", "cd17ee97e06ff23641b1176b9bb2b08cc030f55feb2879b64d5806df9df244eb"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AsyncRAT

False Positive Guidance

• Legacy Java Application Deployment: A standard CI/CD pipeline deploys a legacy Java-based microservice that bundles the AsyncRAT loader DLL (often used for obfuscation or specific memory manipulation in older codebases) into the application artifact. The IOC hash matches the deployed binary on the web server or application node.
  • Filter/Exclusion: Exclude files located in specific application directories (e.g., C:\inetpub\wwwroot\legacy-app\lib\) or exclude hashes associated with known internal build artifacts by correlating with the deployment pipeline ID.
• Third-Party Support Tool Installation: An IT support engineer installs a vendor-provided remote assistance tool (e.g., TeamViewer, AnyDesk, or a custom RMM agent) that shares a common base library or component with the AsyncRAT IOC set. The installer places a shared DLL in C:\Program Files\Common Files\ that matches one of the 10 IOCs.
  • Filter/Exclusion: Exclude files owned by known vendor service accounts or located in standard vendor installation paths (e.g., C:\Program Files\VendorName\) and verify the digital signature matches the expected vendor certificate.
• Scheduled Maintenance Job with Embedded Script: A PowerShell scheduled task runs a maintenance script that downloads a utility from an internal repository. The utility is a wrapper script that embeds a base64-encoded blob matching an AsyncRAT IOC string (used for configuration or payload staging in the specific tool). The hunt detects the string in the temporary script file or the process command line.
  • Filter/Exclusion: Exclude files in temporary directories (%TEMP%, C:\Windows\Temp) created by known service accounts (e.g., svc-maintenance) and correlate with the scheduled task name to ensure it is part of the approved maintenance window.
• Development Environment Testing: