This hunt targets the presence of known AsyncRAT indicators of compromise, which are frequently used by adversaries to establish persistent remote access and execute post-exploitation tasks within Azure environments. Proactively hunting for these IOCs allows the SOC team to identify compromised assets before the malware can leverage its capabilities for lateral movement or data exfiltration, thereby reducing the dwell time of this high-severity threat.
Malware Family: AsyncRAT Total IOCs: 158 IOC Types: sha256_hash, ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 46[.]151[.]182[.]5:8808 | botnet_cc | 2026-09-27 | 75% |
| ip:port | 169[.]58[.]38[.]91:5552 | botnet_cc | 2026-09-27 | 75% |
| ip:port | 169[.]58[.]38[.]91:3110 | botnet_cc | 2026-09-27 | 75% |
| ip:port | 169[.]58[.]38[.]91:4466 | botnet_cc | 2026-09-27 | 75% |
| sha256_hash | 41e24d66f8bb13b08c6a41c4b4a2cbd52056edd2a17bec6f30fe3838db6d1f2d | payload | 2026-09-27 | 50% |
| sha256_hash | 41e312466f1373ef6c505a9663ded5243884f1031993a68f5cb188c713b3aeff | payload | 2026-09-27 | 50% |
| sha256_hash | 41eb6115196af3892e27dba0a38c0376900f7d96b0e5721e4383b5e75d7379e7 | payload | 2026-09-27 | 50% |
| sha256_hash | 41f464b145af2ecb017f8c20e00bf2ac8946e4e16e271007394bf3dd7124400f | payload | 2026-09-27 | 50% |
| sha256_hash | 4203dc4ce4935b271220d68455e7b9a2e0c7898b25d4658a94bff8d703390b96 | payload | 2026-09-27 | 50% |
| sha256_hash | 4172157c4e2af8afae99ea967878b5ebccaf542b21389797a40f940dd357bfa4 | payload | 2026-09-27 | 50% |
| sha256_hash | 4173877efb088a4c67894f89c2c572611f5336923e9719fd8a0b06adad909454 | payload | 2026-09-27 | 50% |
| sha256_hash | 4178938ee85e14e923ce16fb97df87ee4a66f2dd89ebbaeac9754c8f1864ab77 | payload | 2026-09-27 | 50% |
| sha256_hash | 4180f00a3d8e9941072ca3cd093991a27003c857e68cdcc003a32cc0ae7519db | payload | 2026-09-27 | 50% |
| sha256_hash | 4183c251af579c89a098c4572f568312c58fbddad10c887f2e8d88678a33b71f | payload | 2026-09-27 | 50% |
| sha256_hash | 4187623c2862328da86414eefedf4ffc231a3f39011d6791d23e94a8eb6e84a9 | payload | 2026-09-27 | 50% |
| sha256_hash | 4193309d8a2a506d0726270845c5648d641cb275045a1b41f9423d64e4b9d2af | payload | 2026-09-27 | 50% |
| sha256_hash | 41955ff332c22ffa3c2014f4bdffc2db6b5ae75d8289df443929a507dca525cd | payload | 2026-09-27 | 50% |
| sha256_hash | 419929cb29132d4442411144a0836daebe9eddcb9498c583197479a728aac18f | payload | 2026-09-27 | 50% |
| sha256_hash | 419c058df7b9c58165e9772863b7153c9a5457d8e105512325d0109bee8611dd | payload | 2026-09-27 | 50% |
| sha256_hash | 419e34cfb8006481229eb1cc92a4077bb16a1e2349d339577a6c2283574ecb8a | payload | 2026-09-27 | 50% |
| sha256_hash | 41a8e90c1ca61037d807c0895501bd24aea6d13fe39f091ab105b9883a7cfffa | payload | 2026-09-27 | 50% |
| sha256_hash | 41ae3eb86359c776ac1b40faf1eb43eb7d874cbf233444aa3af554257d64e62a | payload | 2026-09-27 | 50% |
| sha256_hash | 41b313d72a020f0fb42781abf812be6375455cdc4f2c439676b4818ede00b839 | payload | 2026-09-27 | 50% |
| sha256_hash | 41c91be497722ef13ba12c9bfe421d2313911dea29cd710cf5b6da8301557d0b | payload | 2026-09-27 | 50% |
| sha256_hash | 41d486ecbc7e076dc64d603fb09dbf0cff934c9816e427d16450aedf95672e9d | payload | 2026-09-27 | 50% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["169.58.38.91", "46.151.182.5"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["169.58.38.91", "46.151.182.5"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for files matching known malicious hashes
// Source: ThreatFox - AsyncRAT
let malicious_hashes = dynamic(["41e24d66f8bb13b08c6a41c4b4a2cbd52056edd2a17bec6f30fe3838db6d1f2d", "41e312466f1373ef6c505a9663ded5243884f1031993a68f5cb188c713b3aeff", "41eb6115196af3892e27dba0a38c0376900f7d96b0e5721e4383b5e75d7379e7", "41f464b145af2ecb017f8c20e00bf2ac8946e4e16e271007394bf3dd7124400f", "4203dc4ce4935b271220d68455e7b9a2e0c7898b25d4658a94bff8d703390b96", "4172157c4e2af8afae99ea967878b5ebccaf542b21389797a40f940dd357bfa4", "4173877efb088a4c67894f89c2c572611f5336923e9719fd8a0b06adad909454", "4178938ee85e14e923ce16fb97df87ee4a66f2dd89ebbaeac9754c8f1864ab77", "4180f00a3d8e9941072ca3cd093991a27003c857e68cdcc003a32cc0ae7519db", "4183c251af579c89a098c4572f568312c58fbddad10c887f2e8d88678a33b71f", "4187623c2862328da86414eefedf4ffc231a3f39011d6791d23e94a8eb6e84a9", "4193309d8a2a506d0726270845c5648d641cb275045a1b41f9423d64e4b9d2af", "41955ff332c22ffa3c2014f4bdffc2db6b5ae75d8289df443929a507dca525cd", "419929cb29132d4442411144a0836daebe9eddcb9498c583197479a728aac18f", "419c058df7b9c58165e9772863b7153c9a5457d8e105512325d0109bee8611dd", "419e34cfb8006481229eb1cc92a4077bb16a1e2349d339577a6c2283574ecb8a", "41a8e90c1ca61037d807c0895501bd24aea6d13fe39f091ab105b9883a7cfffa", "41ae3eb86359c776ac1b40faf1eb43eb7d874cbf233444aa3af554257d64e62a", "41b313d72a020f0fb42781abf812be6375455cdc4f2c439676b4818ede00b839", "41c91be497722ef13ba12c9bfe421d2313911dea29cd710cf5b6da8301557d0b", "41d486ecbc7e076dc64d603fb09dbf0cff934c9816e427d16450aedf95672e9d", "41d5d028b57ab3ef9c82d1ceeb3f6ad6b28bc1302fd07def5e716c094636eabb", "411ca6dd9733c4cf370ab2dcac90d967f51e1a6d244cadeee244ac4eea9dc166", "412476007cd57ca529c83c386125249fbe0952a2522f5d838ffd3fb10a6e1f74", "412847d09e497417755e7c454aa75d43297d9478f2c21ceddfee23c1b044d53e", "412bf42db0c72a8764bd96bcd032c3101ebc20b90e4c6fd5f5f1d668888aeb15", "412ea561f1fddaab3c4a0543031a61b63e762461e32554e2927e6fc0212ac6cb", "412f31014021abfd1926e6d73b9170c2817125e548972660eaa105882f4ab9c0", "412f76ae86fd9e8ecd81a686c3708a4008301fe1186d5993debbf863b8dfb1ab", "412f8a00cc6917a1d772a7996922e4122df7883b56f848f07d5df2d5212a80ab", "413262b0c01a1a2cbac0a1a14b78ff4ade3cffef7dfdb5bf21e16893635f6e9f", "413567f89d3bb109aef807a7de71d0df57a2cecbcb1ab13371a3f29f8b94a51c", "4137e33d157fd7634e894fe71ffd157c08b14e0cbb66d15988034489bc70046f", "4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3", "413faa984295c41e69c16408931dfd9267a625003ba0ce0ee3fffadb2d90da61", "4149de2833beb598b07104c5700ba04cbcba95ac5a77f02c348afe92775d2832", "414e3a7b25f16b78c015a7fd44667a0fd809b399e713f12f48b331693c4bb41f", "414f883bbf5322758c422296faf07253a606900b93400e4e840d18ff90e38afc", "4152aa9073b4490e5e07590c816e5bea59285e51649f3dc1a6f001bb2045ea9f", "4154f7a7ba4654decd8455db3e7dc090bfb736cf33f21d17d4e1bf86225be273", "416395bc17ddc55e0c5bba2a743e9f8eeaa7606ba5871e83fd9072d7c63ce82c", "4171105a7279f34562423c9b581b137228d742f6f2850916c96821bf8849e40d", "40d2b61910debf47c0965b6aefdadcaa7fc5840c44e658df0ac6308b84b007a2", "40d51dbfc438dbf04da507650cc73cfd1ccf369894d330b0bd5b207f8be674df", "40d89205b516adefbc8053ad027918bf81bf5ecfd5dfb61b0200bac9f15a16f4", "40da5be82081d0f0a205474abc614379ce4a655ae84c048353a53b49780fa39f", "40e3b5ffb836a72a3bfe10e818fa5775536f6f34501945bce1c167c62cec92fd", "40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff", "40ef79c8a882c52c37063d8bd9614f7b9eeb49fcf171a7956c056ee4dc423522", "40f4079ae66fc0470478a2a71102a964f1d67b17862479faf6faa8edfe68ff26"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceFileEvents | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps team uses a custom Python or PowerShell script to automate the deployment of a lightweight agent or monitoring tool that shares memory footprint or network behavior characteristics with AsyncRAT (e.g., using http/https for C2-like polling or specific mutex names).
jenkins.exe, gitlab-runner, azure-pipelines-agent) or where the command line contains specific deployment keywords like deploy, install, or update.Scenario: An enterprise endpoint protection platform (EPP) or a specific security tool (e.g., CrowdStrike Falcon, Carbon Black) creates a temporary mutex or uses a specific port range for inter-process communication that overlaps with AsyncRAT’s default IOCs.
falconctl.exe, cb.exe, crowdstrike.exe) or where the mutex name is prefixed with the vendor’s namespace (e.g., Falcon_, CB_).Scenario: A legacy application or a specific Java-based enterprise app (e.g., a custom internal portal) uses a default HTTP port (such as 8080 or 80) for local service communication, which matches the network IOCs for AsyncRAT’s default C2 ports.
10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and the process is a known Java runtime (java.exe) or .NET host (dotnet.exe).