This hunt identifies potential AsyncRAT infections by correlating 14 known indicators of compromise, such as specific file hashes and network connections, to detect the presence of this remote access trojan. Proactively hunting for these IOCs in Azure Sentinel is critical because AsyncRAT provides adversaries with persistent, remote control over compromised endpoints, enabling data exfiltration and lateral movement that can remain undetected without targeted investigation.
Malware Family: AsyncRAT Total IOCs: 14 IOC Types: ip:port, sha256_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 89[.]153[.]179[.]188:24996 | botnet_cc | 2026-09-20 | 75% |
| sha256_hash | 3610fcc54a204281b09095004f02b674cd75bdd83996a1428fdef85645eff3e1 | payload | 2026-09-20 | 100% |
| ip:port | 194[.]26[.]192[.]153:2002 | botnet_cc | 2026-09-20 | 75% |
| ip:port | 185[.]34[.]147[.]35:8808 | botnet_cc | 2026-09-20 | 75% |
| ip:port | 185[.]34[.]147[.]34:8808 | botnet_cc | 2026-09-20 | 75% |
| ip:port | 185[.]34[.]147[.]33:8808 | botnet_cc | 2026-09-20 | 75% |
| ip:port | 185[.]34[.]147[.]32:8808 | botnet_cc | 2026-09-20 | 75% |
| ip:port | 185[.]34[.]147[.]31:8808 | botnet_cc | 2026-09-20 | 75% |
| ip:port | 185[.]34[.]147[.]32:7707 | botnet_cc | 2026-09-20 | 75% |
| ip:port | 185[.]34[.]147[.]31:7707 | botnet_cc | 2026-09-20 | 75% |
| ip:port | 128[.]90[.]59[.]115:7070 | botnet_cc | 2026-09-20 | 75% |
| ip:port | 121[.]200[.]216[.]74:8808 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 91[.]92[.]241[.]149:90 | botnet_cc | 2026-09-19 | 75% |
| ip:port | 67[.]43[.]56[.]25:6606 | botnet_cc | 2026-09-19 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["89.153.179.188", "185.34.147.31", "185.34.147.33", "185.34.147.34", "121.200.216.74", "91.92.241.149", "67.43.56.25", "194.26.192.153", "185.34.147.32", "128.90.59.115", "185.34.147.35"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["89.153.179.188", "185.34.147.31", "185.34.147.33", "185.34.147.34", "121.200.216.74", "91.92.241.149", "67.43.56.25", "194.26.192.153", "185.34.147.32", "128.90.59.115", "185.34.147.35"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for files matching known malicious hashes
// Source: ThreatFox - AsyncRAT
let malicious_hashes = dynamic(["3610fcc54a204281b09095004f02b674cd75bdd83996a1428fdef85645eff3e1"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceFileEvents | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
asyncrat.exe or specific DLLs) in isolated lab environments or CI/CD pipelines to test reverse proxy configurations or client-server communication. To avoid noise, exclude hosts tagged with dev, test, or lab in your asset inventory, or filter out processes originating from standard development directories like C:\Users\<dev>\AppData\Local\Temp or C:\src\projects.svc_support, it_helpdesk) or specific process paths associated with these approved tools.Task Scheduler (taskschd.msi) or svchost.exe running under the LocalService or NetworkService account, and exclude paths within C:\Windows\Temp or C:\ProgramData if the IOCs are file-based.C:\Program Files\Installers or C:\Users\<user>\Downloads when the parent process is `