ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt targets the presence of AsyncRAT indicators of compromise, a remote access tool frequently used by threat actors to establish persistent control over compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify and isolate infected hosts before the adversary can leverage the RAT for lateral movement or data exfiltration.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 14 IOC Types: sha256_hash, ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	102[.]220[.]160[.]198:2026	botnet_cc	2026-09-12	75%
sha256_hash	ea0ac7277d0fdf801972b56bdc57184fc51ac8be47438873396436736f3694a9	payload	2026-09-12	100%
sha256_hash	ea0c84717977b89e7c7c885c68ac7ab4d8e561044cd93b47f3ddf830f9f688cd	payload	2026-09-12	100%
sha256_hash	ea12af0b71bfa241c4430a06ddcfa129be2f314491e304c8879875e54c736e69	payload	2026-09-12	100%
sha256_hash	ea133e93a0301c980571d41a97fcaea4f92290be2d1fbf87b26a248a64320636	payload	2026-09-12	100%
sha256_hash	ea13d9b4eeb50863243709393c454bb05040360e23978ae94530b5b0063ac09f	payload	2026-09-12	100%
sha256_hash	ea147cfa0413bd0f67d0de1478929cf1815386562efbc183c162378be39d5715	payload	2026-09-12	100%
sha256_hash	ea1a02105dd7f3e59089e9f0d63c958e48025da81f0d15c4fd610b12c7d61673	payload	2026-09-12	100%
sha256_hash	ea1adb71ddfe3979fd618e26e6d22cbd61545fb5a5fb33137a8610bbc2d7202d	payload	2026-09-12	100%
sha256_hash	ea1c9ee453e17ae228c7aeebd2582572eb495bdf25a307d16f27d113cba69ff8	payload	2026-09-12	100%
sha256_hash	ea251bf7fcc0a42cb9e954a45d925ef379ef1ffca39e482f44af701b4ace8560	payload	2026-09-12	100%
sha256_hash	ea25b6e75395d2ba68c88a7fec12236274f29126fe9cfe6ac1401590b50570a9	payload	2026-09-12	100%
sha256_hash	ea30f01cff0ddb4ce05f1b5a864040cefafc92b2eea634c0d9b971d289246fac	payload	2026-09-12	100%
sha256_hash	ea324fad712ec25e1d05c8c37b7651d1c715b84075b6cde743b5cc25d7c68e78	payload	2026-09-12	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["102.220.160.198"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["102.220.160.198"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - AsyncRAT
let malicious_hashes = dynamic(["ea0ac7277d0fdf801972b56bdc57184fc51ac8be47438873396436736f3694a9", "ea0c84717977b89e7c7c885c68ac7ab4d8e561044cd93b47f3ddf830f9f688cd", "ea12af0b71bfa241c4430a06ddcfa129be2f314491e304c8879875e54c736e69", "ea133e93a0301c980571d41a97fcaea4f92290be2d1fbf87b26a248a64320636", "ea13d9b4eeb50863243709393c454bb05040360e23978ae94530b5b0063ac09f", "ea147cfa0413bd0f67d0de1478929cf1815386562efbc183c162378be39d5715", "ea1a02105dd7f3e59089e9f0d63c958e48025da81f0d15c4fd610b12c7d61673", "ea1adb71ddfe3979fd618e26e6d22cbd61545fb5a5fb33137a8610bbc2d7202d", "ea1c9ee453e17ae228c7aeebd2582572eb495bdf25a307d16f27d113cba69ff8", "ea251bf7fcc0a42cb9e954a45d925ef379ef1ffca39e482f44af701b4ace8560", "ea25b6e75395d2ba68c88a7fec12236274f29126fe9cfe6ac1401590b50570a9", "ea30f01cff0ddb4ce05f1b5a864040cefafc92b2eea634c0d9b971d289246fac", "ea324fad712ec25e1d05c8c37b7651d1c715b84075b6cde743b5cc25d7c68e78"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
CommonSecurityLog	Ensure this data connector is enabled
DeviceFileEvents	Ensure this data connector is enabled
DeviceNetworkEvents	Ensure this data connector is enabled

References

• ThreatFox — AsyncRAT

False Positive Guidance

• Scenario: A DevOps team deploys a custom Python-based automation script that uses the socket library to establish persistent connections for real-time log streaming or remote debugging, inadvertently matching the specific IP:Port or Hash IOCs associated with AsyncRAT’s C2 channels.
  • Filter/Exclusion: Exclude processes where the parent process is python.exe or python3.exe and the command line contains keywords like --log-stream, --debug, or asyncio. Alternatively, whitelist the specific executable hash if it is signed by the internal CI/CD pipeline.
• Scenario: An enterprise IT administrator runs a scheduled PowerShell job (Invoke-AsyncRatCheck) to audit remote access tools across the fleet, which temporarily loads AsyncRAT-related DLLs or creates temporary files with known IOCs for comparison purposes.
  • Filter/Exclusion: Exclude events where the initiating user belongs to the IT-Admins or Service-Accounts AD group and the process path resides in C:\ProgramData\IT-Audit\ or similar administrative staging directories.
• Scenario: A security testing team executes a YARA rule scan or uses a tool like YARA-Native to hunt for AsyncRAT signatures in memory dumps or disk images, causing the detection engine to flag the scanner’s own memory footprint or temporary output files.
  • Filter/Exclusion: Exclude processes named yara.exe, yara64.exe, or memdump.exe and any child processes spawned by them. Additionally, exclude file paths containing \yara-scan\ or \forensics\.
• Scenario: A legacy application or third-party monitoring agent (e.g., a custom Java-based health check tool) uses a hardcoded IP address or port that coincidentally matches one of the 14 AsyncRAT IOCs