We're gradually updating threat actor names in our reports to align with the new weather-themed taxonomy. Learn about Microsoft threat actor names
Trojan:Win64/AsyncRat.RPY!MTB
Aliases: No associated aliases
Summary
Trojan:Win64/AsyncRat.RPY!MTB is a standout as a versatile remote access trojan that first appeared on GitHub in 2019, positioned as a legitimate open-source remote management utility. However, records confirm that following its launch, it has been co-opted for illicit operations by threat actors, including entry-level cybercriminals and organized syndicates tied to ransomware efforts. It is built on the .NET framework, which provides threat actors with full control over a compromised device.
The infection chain commonly starts with phishing campaigns that deliver malicious scripts or ISO images, leading to the deployment of the payload. To maintain persistence, the malware creates scheduled tasks or registry run keys, and it employs advanced anti-analysis techniques to evade detection, including virtual machine checks, debugger detection, and patching security features. Communication with command and control (C2) servers occurs over custom TCP ports, using efficient serialization for data exfiltration and system reconnaissance.
Its core functionality encompasses comprehensive surveillance and system manipulation, including keylogging, audio/video recording, file theft, and remote shell access. It can deactivate security software and propagate through networks. Detection relies on behavioral monitoring for anomalies such as unusual process injections, particularly into .NET processes like RegSvcs.exe, and network connections to suspicious domains or IP addresses. Its versatility and ongoing development from an open-source codebase make it a persistent and adaptable threat.
The “!MTB” suffix refers to Machine Threat Behavior, which indicates that this trojan was detected using behavioral analysis or machine learning models. Instead of relying on a static signature (like a known file hash), the antivirus engine identified the program's actions, sequence of operations, or code patterns as malicious. These patterns are consistent with the known behavior of the AsyncRAT family.
- Disconnect the infected device from all networks (both wired and wireless) to sever the command-and-control connection.
- Check the Windows Task Scheduler or Process Explorer for malicious tasks like "Reklam" and delete them.
- Examine the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run registry hive for any suspicious entries and remove them.
- Navigate to directories like %temp%, %AppData%, and C:\Users\Public\ and look for recently created, suspicious binary or script files, then delete them.
Microsoft Defender Antivirus automatically removes threats as they are detected. However, many infections can leave remnant files and system changes. Updating your antimalware definitions and running a full scan might help address these remnant artifacts.
You can also visit our advanced troubleshooting page or search the Microsoft virus and malware community for more help.
