ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the deployment of AsyncRAT remote access trojans by monitoring for matches against a specific set of 16 known indicators of compromise. Proactively hunting for these IOCs in Azure Sentinel is critical to rapidly identify and contain active infections before attackers can establish persistent command-and-control channels or exfiltrate sensitive data.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 16 IOC Types: sha256_hash, ip:port, domain

Type	Value	Threat Type	First Seen	Confidence
ip:port	`192[.]162[.]199[.]149:7707`	botnet_cc	2026-06-28	75%
ip:port	`167[.]94[.]81[.]175:62722`	botnet_cc	2026-06-28	75%
ip:port	`149[.]50[.]96[.]57:8000`	botnet_cc	2026-06-28	100%
ip:port	`116[.]62[.]100[.]25:8808`	botnet_cc	2026-06-28	100%
ip:port	`178[.]83[.]121[.]60:48203`	botnet_cc	2026-06-27	75%
ip:port	`155[.]94[.]163[.]75:8797`	botnet_cc	2026-06-27	75%
ip:port	`107[.]174[.]142[.]104:6578`	botnet_cc	2026-06-27	75%
ip:port	`107[.]174[.]142[.]104:7790`	botnet_cc	2026-06-27	75%
ip:port	`154[.]86[.]119[.]228:80`	botnet_cc	2026-06-27	75%
domain	`yigu360.com`	botnet_cc	2026-06-27	75%
sha256_hash	`66800eefed4e4c7dae18fe4dfe388e5f0ef20159cf0c7188df6c1a1d88f63a03`	payload	2026-06-27	100%
sha256_hash	`2eebecf7c504a215a51fb2876ec4f646b252fea92b43a6c5a811b8338f0ed133`	payload	2026-06-27	100%
sha256_hash	`6bdc600936975f49a706081d941b5de37f23586828a13aded77e015cf01cccc5`	payload	2026-06-27	100%
sha256_hash	`f636f4b5522e2a1c341fd1064190fe714a2965b4432b0bfe57c05233a60f611f`	payload	2026-06-27	100%
domain	`thkjhg.cn`	payload_delivery	2026-06-27	100%
domain	`yfps3ls.cn`	payload_delivery	2026-06-27	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["154.86.119.228", "167.94.81.175", "192.162.199.149", "178.83.121.60", "149.50.96.57", "155.94.163.75", "116.62.100.25", "107.174.142.104"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["154.86.119.228", "167.94.81.175", "192.162.199.149", "178.83.121.60", "149.50.96.57", "155.94.163.75", "116.62.100.25", "107.174.142.104"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - AsyncRAT
let malicious_domains = dynamic(["yigu360.com", "thkjhg.cn", "yfps3ls.cn"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - AsyncRAT
let malicious_hashes = dynamic(["66800eefed4e4c7dae18fe4dfe388e5f0ef20159cf0c7188df6c1a1d88f63a03", "2eebecf7c504a215a51fb2876ec4f646b252fea92b43a6c5a811b8338f0ed133", "6bdc600936975f49a706081d941b5de37f23586828a13aded77e015cf01cccc5", "f636f4b5522e2a1c341fd1064190fe714a2965b4432b0bfe57c05233a60f611f"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceFileEvents`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled
`DnsEvents`	Ensure this data connector is enabled

References

ThreatFox — AsyncRAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

Endpoint Protection Scanning of Quarantined Archives
- Scenario: Enterprise Endpoint Detection and Response (EDR) agents, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, periodically scan the C:\ProgramData\ThreatFox\Quarantine directory. If a previous investigation archived a benign file containing AsyncRAT signatures (e.g., a known test payload), the EDR’s real-time scanning engine may trigger the detection logic upon accessing these specific IOCs, mistaking the archival activity for an active threat scan.
- Filter/Exclusion: Exclude network traffic and process execution originating from the EDR service accounts (e.g., svc-crowdstrike or LocalSystem) specifically when the source path matches the quarantine directory (C:\ProgramData\ThreatFox\Quarantine).
Scheduled Vulnerability Management Scans
- Scenario: The organization runs a nightly vulnerability assessment using Tenable Nessus or Qualys. During these scans, the scanner agent injects temporary test files into user home directories to verify patch levels. If the scan configuration includes a “RAT Simulation” module that deploys AsyncRAT-like binaries for testing, the detection rule will flag these legitimate deployment artifacts as potential IOCs matches.
- Filter/Exclusion: Create an exclusion based on the parent process name TenableAgent.exe or QualysPCAgent.exe and restrict the alert to only trigger outside of the scheduled maintenance window (e.g., exclude events between 02:00 and 04:00 UTC).
Software Deployment via Configuration Management Tools
- Scenario: The IT Operations