AsyncRAT - Distribution Methods

File types, delivery vectors, and hosting infrastructure used to distribute AsyncRAT.

Last updated: 2026-04-18

Understanding how AsyncRAT reaches victims is critical for prevention. This page breaks down the file types used in distribution, the hosting infrastructure serving malicious payloads, and URLs tracked by URLhaus. Data is updated daily.

What Distribution Data Tells You

Shifts in file type distribution often signal changes in delivery tactics. For example, a move from .exe to .msi files may indicate operators adapting to Windows SmartScreen or email gateway filtering. A surge in .js or .vbs files suggests script-based delivery through phishing emails. Monitoring these patterns helps you tune your email security gateway rules and endpoint protection policies to block the current delivery method before it reaches end users.

Hosting Infrastructure

The hosting data below shows which domains and servers are actively distributing AsyncRAT payloads. Add these to your DNS blocklists, web proxy deny rules, and firewall policies. Hosting infrastructure tends to rotate frequently as takedowns occur, so check this page regularly. All URL data is sourced from URLhaus. For hash-based indicators, see the IOC page. For sample details, see AsyncRAT samples.

File Types (73 samples)

exe 52 (71%)
vbs 15 (21%)
js 2 (3%)
ps1 2 (3%)
bat 2 (3%)

Malicious Distribution URLs (56)

http://81.163.111.127:8000/eww.exe
http://81.163.111.127:8000/swchost.exe
http://81.163.111.127:8000/swchost2.exe
http://81.163.111.127:8000/install3.exe
http://81.163.111.127:8000/81ip.exe
http://81.163.111.127:8000/workin.exe
https://accessible-peach-termite.myfilebase.com/ipfs/QmVzGgstGZeBYcqnvndsS3fDWp8Dixo4UAX1exjGmSaSVn?download=true&filename=7777778.txt
https://accessible-peach-termite.myfilebase.com/ipfs/QmVzGgstGZeBYcqnvndsS3fDWp8Dixo4UAX1exjGmSaSVn?
https://firebasestorage.googleapis.com/v0/b/spenglercomics.firebasestorage.app/o/task.txt?alt=media&token=f162f5ce-52f7-4407-8cc4-dd96cedd9b0e
http://62.60.226.159/ability_3759.42.6_INSTALL.exe
https://epgoldsecurity.com/XWormClient.exe
https://epgoldsecurity.com/XWormClient2.exe
http://192.177.26.196/files/6334661508/lzyfkOs.exe
http://209.38.18.1/cbot/licenseservice.exe
http://209.38.18.1/cbot/svchost.exe
http://209.38.18.1/cbot/System.exe
http://158.94.208.168/files/2038862353/UbL56O6.exe
http://158.94.208.168/files/6334661508/lzyfkOs.exe
https://github.com/moyousry95/slash2/raw/refs/heads/main/Security.exe
https://github.com/moyousry95/slash/raw/refs/heads/main/Graphics.exe
https://raw.githubusercontent.com/moyousry95/slash/refs/heads/main/SecurityHealthSystry.exe
https://raw.githubusercontent.com/moyousry95/slash/refs/heads/main/Graphics.exe
https://raw.githubusercontent.com/moyousry95/slash2/refs/heads/main/Security.exe
http://156.233.71.230/EN/Exe/nhFRAN/interac.bat
http://156.233.71.230/EN/Exe/nhFRAN/interac.exe
https://github.com/xbox360modderv3/gggbig/raw/refs/heads/main/AsyncClient3.exe
https://raw.githubusercontent.com/xbox360modderv3/gggbig/refs/heads/main/AsyncClient3.exe
https://github.com/xbox360modderv3/gggbig/raw/refs/heads/main/AsyncClient4.exe
https://raw.githubusercontent.com/xbox360modderv3/gggbig/refs/heads/main/AsyncClient4.exe
https://github.com/xbox360modderv3/hhg55/raw/refs/heads/main/AsyncClient5.exe
https://raw.githubusercontent.com/xbox360modderv3/hhg55/refs/heads/main/AsyncClient5.exe
https://github.com/xbox360modderv3/ddjfj/raw/refs/heads/main/AsyncClient1.exe
https://raw.githubusercontent.com/xbox360modderv3/ddjfj/refs/heads/main/AsyncClient1.exe
https://www.almacensantangel.com/ENCRY090PT.Ps1
http://www.almacensantangel.com/ENnmCRYPT.Ps1
http://158.94.208.7/files/8535406641/AYRS45O.exe
https://compimento.ba/asyncdecenimg_050306.png
http://85.137.253.58:9000/svchost.exe
http://85.137.253.58:9000/XClient.exe
https://dl.dropboxusercontent.com/scl/fi/x97ra6bino9olbolx8ha8/optimized_MSI.png?rlkey=ek4gmta3ih6tg3kq3m9su1zsr&st=ao90xecu&dl=0?id=661120a4-f576-4e8f-bc6a-7b48650ac68c
https://fertas.com.tr/fish.txt
https://github.com/ademmartinez71-cmd/test/raw/refs/heads/main/XClient.exe
https://raw.githubusercontent.com/ademmartinez71-cmd/test/refs/heads/main/XClient.exe
http://158.94.211.222/files/2070717540/IPvJTgG.bat
http://msidownloads.duckdns.org/Nueva%20carpeta/vm.png
http://ia600705.us.archive.org/23/items/optimized_msi_20260303/optimized_MSI.png
https://wpgbf1zg-5500.euw.devtunnels.ms/loader/RANKUP/FREE/FreeFortniteCheat.zip
https://loader-400.pages.dev/MRX/FreeFortniteCheat.zip
https://wpgbf1zg-5500.euw.devtunnels.ms/64/64th%20Services.exe
https://wpgbf1zg-5500.euw.devtunnels.ms/64/loader.exe
https://loader-400.pages.dev/64/64thServices%20v24.zip
http://130.12.180.43/files/8408827406/AHUfa84.exe
http://archive.org/download/optimized_msi_20260226_1507/optimized_MSI.png
https://wpgbf1zg-5500.euw.devtunnels.ms/free.exe
https://loader-400.pages.dev/RANKUP/FREE/FreeFortniteCheat.zip
https://wpgbf1zg-5500.euw.devtunnels.ms/rankup/freetemp/RankupServiceFreeTemp.exe

Source: URLhaus (abuse.ch). Updated: 2026-04-18

Hosting Infrastructure

Host URLs
raw.githubusercontent.com 8
github.com 7
81.163.111.127 6
wpgbf1zg-5500.euw.devtunnels.ms 5
209.38.18.1 3
loader-400.pages.dev 3
accessible-peach-termite.myfilebase.com 2
epgoldsecurity.com 2
158.94.208.168 2
156.233.71.230 2
www.almacensantangel.com 2
85.137.253.58 2
firebasestorage.googleapis.com 1
62.60.226.159 1
192.177.26.196 1
158.94.208.7 1
compimento.ba 1
dl.dropboxusercontent.com 1
fertas.com.tr 1
158.94.211.222 1