We're gradually updating threat actor names in our reports to align with the new weather-themed taxonomy. Learn about Microsoft threat actor names
Trojan:BAT/AsyncRAT.KC!MTB
Aliases: No associated aliases
Summary
Trojan:BAT/AsyncRAT.KC!MTB (Asynchronous Remote Access Trojan) is a sophisticated, feature-rich malware that provides threat actors with full remote control over compromised Windows devices. First published as open-source software on GitHub in 2019, its code has been weaponized and modified by a diverse range of threat actors. This open-source nature has made AsyncRAT a cornerstone of modern malware, leading to a sprawling network of variants and allowing its use in extensive phishing campaigns that target organizations worldwide across multiple sectors.
The "BAT" variant refers to a specific and complex infection chain often initiated by phishing emails. In this method, threat actors use obfuscated batch (.bat) files as the initial loader. This script employs advanced obfuscation to evade detection by hiding an encrypted AsyncRAT payload within its own code. When launched, the batch script deploys PowerShell to decrypt, assemble, and runs the final AsyncRAT payload in the device’s memory, a technique that leaves minimal traces on the disk. Recent campaigns have evolved to use multiple file types and abuse legitimate services like TryCloudflare and Dropbox to host these malicious scripts, making the initial infection harder to detect and block.
The “!MTB” suffix refers to Machine Threat Behavior, which indicates that this trojan was detected using behavioral analysis or machine learning models. Instead of relying on a static signature (like a known file hash), the antivirus engine identified the program's actions, sequence of operations, or code patterns as malicious. These patterns are consistent with the known behavior of the AsyncRat family.
- Disconnect the infected device from all networks (both wired and wireless) to sever the command-and-control connection.
- Check the Windows Task Scheduler or Process Explorer for malicious suspicious processes related to cmd.exe, powershell.exe, or any unknown binaries. to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. Carefully delete any entries pointing to malicious files.
- Open Windows Task Scheduler and delete any malicious tasks you've identified.
- On a clean device, change all passwords that were used or stored on the infected device.
Microsoft Defender Antivirus automatically removes threats as they are detected. However, many infections can leave remnant files and system changes. Updating your antimalware definitions and running a full scan might help address these remnant artifacts.
You can also visit our advanced troubleshooting page or search the Microsoft virus and malware community for more help.
