RAT
AsyncRAT
RAT
14 detections found
Also known as: Async RAT, Trojan.AsyncRAT, Backdoor.AsyncRAT, NYANxCAT
AsyncRAT is an open-source, C#-based remote access trojan originally published on GitHub (derived from the NYANxCAT project) that provides screen capture, keylogging, credential theft, and remote command execution over an encrypted C2 channel. Its public source code has spawned a large ecosystem of forks and commercial crypters (e.g., the 3LOSH crypter tracked by Cisco Talos), and it remains one of the most commonly delivered commodity RATs in phishing and malvertising campaigns. Recent incident-response reporting (Trend Micro, 2023) documents it being injected into legitimate Windows processes such as aspnet_compiler.exe to evade detection.
Detection & eradication references
Curated links to authoritative sources — MITRE ATT&CK, CISA advisories, law-enforcement takedown announcements, and vendor threat-intel writeups — for removal, remediation, and further technical detail. Sigma Watch does not publish its own removal steps here, since malware behavior and tooling change too fast for a static write-up to stay reliably accurate.
- AsyncRAT, Software S1087 — MITRE ATT&CK
- Threat Spotlight: AsyncRAT campaigns feature new version of 3LOSH crypter — Cisco Talos
- Analyzing AsyncRAT's Code Injection into Aspnet_Compiler.exe — Trend Micro
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| suricata | ET MALWARE AsyncRAT Powershell Payload | rev 1 | 2026-09-18 |
| snort | ET TROJAN AsyncRAT Powershell Payload | rev 1 | 2026-09-18 |
| splunk | Windows Scheduled Task with Highest Privileges | production | 2026-05-13 |
| splunk | Cisco Secure Firewall - Intrusion Events by Threat Activity | production | 2026-05-13 |
| splunk | Windows Spearphishing Attachment Onenote Spawn Mshta | production | 2026-05-13 |
| suricata | ET ATTACK_RESPONSE Observed AsyncRat Installer Inbound | rev 1 | 2025-08-20 |
| snort | ET ATTACK_RESPONSE Observed AsyncRat Installer Inbound | rev 1 | 2025-08-20 |
| suricata | ET MALWARE AsyncRAT Installer Payload Request | rev 1 | 2025-03-06 |
| snort | ET TROJAN AsyncRAT Installer Payload Request | rev 1 | 2025-03-06 |
| sigma | File Creation Related To RAT Clients | experimental | 2024-12-19 |
| snort | ET TROJAN ASYNC RAT Payload Inbound | rev 1 | 2024-07-24 |
| suricata | ET MALWARE ASYNC RAT Payload Inbound | rev 1 | 2024-07-24 |
| yara | HKTL_NET_GUID_AsyncRAT_C_Sharp | — | — |
| yara | win_asyncrat_j1 | — | — |