user@threatcheck.sh ~ threat-analysis
bash
$ analyze-threat Trojan:MSIL/AsyncRat.ABJU!MTB
Trojan:MSIL/AsyncRat.ABJU!MTB - Windows Defender threat signature analysis

Trojan:MSIL/AsyncRat.ABJU!MTB - Windows Defender Threat Analysis

$ cat analysis.txt
=== THREAT ANALYSIS REPORT ===
Threat Name: Trojan:MSIL/AsyncRat.ABJU!MTB
Classification:
Type:Trojan
Platform:MSIL
Family:AsyncRat
Detection Type:Concrete
Known malware family with identified signatures
Variant:ABJU
Specific signature variant within the malware family
Suffix:!MTB
Detected via machine learning and behavioral analysis
Detection Method:Behavioral
Confidence:Very High
False-Positive Risk:Low

Concrete signature match: Trojan - Appears legitimate but performs malicious actions for .NET (Microsoft Intermediate Language) platform, family AsyncRat

Summary:

This detection identifies the AsyncRat Remote Access Trojan (RAT), a malicious program designed to give an attacker complete control over the infected system. Once installed, it can be used to steal sensitive information, log keystrokes, access webcams, and execute remote commands. The '!MTB' suffix indicates this was identified by a machine learning behavioral model.

Severity:
Medium
VDM Static Detection:
No specific strings found for this threat
YARA Rule:
rule Trojan_MSIL_AsyncRat_ABJU_2147841601_0
{
    meta:
        author = "threatcheck.sh"
        detection_name = "Trojan:MSIL/AsyncRat.ABJU!MTB"
        threat_id = "2147841601"
        type = "Trojan"
        platform = "MSIL: .NET intermediate language scripts"
        family = "AsyncRat"
        severity = "Critical"
        info = "MTB: Microsoft Threat Behavior"
        signature_type = "SIGNATURE_TYPE_PEHSTR_EXT"
        threshold = "7"
        strings_accuracy = "Low"
    strings:
        $x_3_1 = {0a 06 18 6f ?? ?? ?? 0a 06 6f ?? ?? ?? 0a 13 04 02 0d 11 04 09 16 09 8e b7 6f ?? ?? ?? 0a 0b de 11 de 0f 3d 00 06 08 28 ?? ?? ?? 0a 7e ?? ?? ?? 04 6f ?? ?? ?? 0a 6f ?? ?? ?? 0a 6f}  //weight: 3, accuracy: Low
        $x_1_2 = "GetBytes" ascii //weight: 1
        $x_1_3 = "SymmetricAlgorithm" ascii //weight: 1
        $x_1_4 = "CreateDecryptor" ascii //weight: 1
        $x_1_5 = "TransformFinalBlock" ascii //weight: 1
    condition:
        (filesize < 20MB) and
        (all of ($x*))
}
Known malware which is associated with this threat:
bca26771b9c277eb8babfaf06af7dae3f8b063b1b91b090691bf69d265dc0ff8
05/12/2025
→VirusTotal↓Download Sample
Filename: SecuriteInfo.com.Trojan.MulDropNET.78.32007.10377
8f20020d5b0669c889435750b00452672cb17fc2a87225a5341040bc05afc008
05/12/2025
→VirusTotal↓Download Sample
bb217671489213dfb4eefff0d0af47621615d9a0c85415c0e31f2cb08786d359
03/12/2025
→VirusTotal↓Download Sample
aaf95f1cd7a0fa3dbfe0a180066e2415cb5605f643c70ed1dfd063b5ebb72241
01/12/2025
→VirusTotal↓Download Sample
d78bc79af620792cce544f3844c16cd35b77427759cf77966c8dbec0ce9519a4
21/11/2025
→VirusTotal↓Download Sample
Remediation Steps:
Immediately isolate the machine from the network to prevent further compromise. Use security software to quarantine the threat and perform a full system scan. Investigate the initial infection vector and consider resetting credentials used on the device.
=== END REPORT ===
$ reanalyze-threat
This analysis was last updated on 08/11/2025. Do you want to analyze it again?
$ ls available-commands/
→ cd /home
user@threatcheck.sh:~$ ▊