Backdoor:MSIL/AsyncRAT: what it is and how to remove it from Windows

What Backdoor:MSIL/AsyncRAT is, and what it is not

Backdoor:MSIL/AsyncRAT is the name Microsoft Defender gives to a file built from AsyncRAT, a free remote control program for Windows. The program was written to watch and control other computers, and on a PC where nobody asked for it, it works as a backdoor that lets a stranger in.

1. 1

   What the author says it is

   The project page on GitHub calls AsyncRAT a remote administration tool for Windows written in C#, designed to monitor and control other computers over an encrypted connection. It is free and open source under the MIT License, so anyone can download it, change it and build their own copy. The author's legal disclaimer says the software was made for educational purposes only and must not be used on any system you do not own or have permission to operate.

2. 2

   What MITRE and Microsoft say it is

   MITRE ATT&CK (software S1087) describes AsyncRAT as an open-source remote access tool, first shared through the NYAN-x-CAT repository, that has been used in malicious campaigns. Microsoft calls its detections a sophisticated and persistent backdoor whose central goal is a hidden and lasting channel for remote control. Our 2020 guide described the same thing: a surveillance or educational tool that criminals turned into malware.

3. 3

   How it works

   AsyncRAT has a server and a client. The person in control runs the server, uses its builder to produce the client file, and sees every connected PC in a list. The client is the file that runs on the victim's PC, calls home and waits for commands. The project says the client needs .NET Framework 4 and the server 4.6 or newer, and that extra functions arrive as plugins sent from the server.

4. 4

   What a backdoor and a RAT are

   A backdoor is a way into a computer that goes around the normal checks, such as a sign-in. A remote access tool (RAT) is a program that lets one person operate another computer from a distance. Help desks use such tools legitimately. A remote access trojan is the same kind of program delivered secretly, which is why one name can describe both a lab tool and an intruder.

5. 5

   Why Microsoft's name looks like code

   In Backdoor:MSIL/AsyncRAT, Backdoor is the category and MSIL means Microsoft Intermediate Language, the form .NET programs are compiled to. AsyncRAT is the family. The suffix after the exclamation mark, !MTB, stands for Machine Threat Behavior: Microsoft says it means the file was flagged by behavior or machine-learning models, not by one fixed signature. A letter group such as .YA marks a variant.

6. 6

   What our 2020 guide got wrong or left out

   It said the malware mainly targets organizations; Proofpoint's reports show mass email to ordinary recipients as well. It said a backdoor grants administrator permissions; AsyncRAT only checks whether the current user is an administrator. It also named a Spamhaus botnet and a group called Mo Lou Qi that we could not confirm. Each point is corrected in the chapter where it belongs.

Also called

AsyncRAT; AsyncRAT-C-Sharp (the repository name); Backdoor:MSIL/AsyncRAT!MTB and Backdoor:MSIL/AsyncRAT.YA!MTB (Microsoft's two names for the detections our 2020 guide listed)

Made by

GitHub user NYAN-x-CAT; open source under the MIT License, so copies and edited builds circulate widely

Project start

First commit on 19 January 2019; latest release v0.5.8 on 16 October 2023 (the page we read showed 430 commits)

Language and platform

C#; Windows only; needs the .NET Framework

Microsoft entries

Backdoor:MSIL/AsyncRAT.YA!MTB, published 21 May 2019; Backdoor:MSIL/AsyncRAT!MTB, published 18 May 2020 (both updated in December 2025); Trojan:Win32/AsyncRAT.SA, published 18 November 2025, for a 32-bit build, with a separate 64-bit family named Trojan:Win64/AsyncRat

Groups named in MITRE

TA2541, APT-C-36 (a customised version) and MirrorFace; Proofpoint separately tracked TA2719 using AsyncRAT in 2020

Trojan:MSIL/AsyncRAT!rfn: is it the same as Backdoor:MSIL/AsyncRAT?

Trojan:MSIL/AsyncRAT!rfn is most likely another Microsoft Defender label for the same AsyncRAT remote access tool, but we could not confirm that.

We found no Microsoft encyclopedia entry for this exact name, so the reading in this section is ours and not a Microsoft statement. Treat the alert as real until you have checked the file.

The first part of a Microsoft name, such as Trojan or Backdoor, is the category Microsoft gives a detection. MSIL means the file is a .NET program, and AsyncRAT is written in C#. That fits our reading that Trojan:MSIL/AsyncRAT and Backdoor:MSIL/AsyncRAT point at the same family, only under different category labels.

The text after the exclamation mark, here rfn, is a suffix that Microsoft adds to a detection. We found no Microsoft page that explains rfn, so we will not guess what it means. Suffixes like !MTB are described in this guide, and the steps below do not depend on which suffix your alert shows.

If Defender shows this name, open Windows Security, then Protection history, and note the file path and what action Defender took. Then follow the removal steps in this guide from the top, starting with disconnecting the PC and changing your passwords from another device.

What we checked on 6 October 2026, and what we could not

There is no website to test here and we did not run a sample. We read Microsoft's three entries, MITRE ATT&CK, the project page, Proofpoint's 2020 report and a June 2026 report on a new campaign. We ran nothing on a PC.

AsyncRAT from open-source tool to commodity malware, 2019 to 2026

Our guide dates from 30 September 2020. Its newest facts were Proofpoint's 2020 report and the two Microsoft names; the entries from 2021 on are new here.

1. 19 January 2019

   The project starts

   The first commit in the AsyncRAT-C-Sharp repository is dated 19 January 2019. The code stays public under the MIT License.

2. 21 May 2019

   Microsoft publishes Backdoor:MSIL/AsyncRAT.YA!MTB

   This is the earlier of Microsoft's two entries. The alert in our 2020 lead picture carried this name.

   

3. Late March 2020

   TA2719 starts with NanoCore

   Proofpoint began tracking a new actor, TA2719, that sent localized lures with colorful images impersonating local banks, police and shipping services. From March to early July it spread NanoCore, mostly as ISO attachments.

4. 10 May 2020

   New features released

   Proofpoint noted that AsyncRAT still looked under active development, with new features released on 10 May 2020.

5. 18 May 2020

   Microsoft publishes Backdoor:MSIL/AsyncRAT!MTB

   The second entry, now the one most alerts quote. Microsoft updated both entries on 2 and 3 December 2025.

6. Mid-July 2020

   TA2719 switches to AsyncRAT

   Proofpoint's report of 26 August 2020 says the actor pivoted from NanoCore to AsyncRAT, still by email attachment, in low-volume campaigns that reached recipients in countries from Chile to Taiwan. Its command servers changed roughly once a month.

   

7. 30 September 2020

   Our first guide

   The 2020 guide treated AsyncRAT as a dangerous backdoor, listed its functions and named TA2719, a group called Mo Lou Qi and a Spamhaus botnet. TA2719 is confirmed; the other two we could not find in the sources we read.

   

8. 2021 to 2022

   AsyncRAT inside loaders and long campaigns

   MITRE's references for AsyncRAT include Morphisec's May 2021 report on the Snip3 crypter, which it calls a highly evasive RAT loader, Cisco Talos on a five-year attack on the aviation industry and Proofpoint's February 2022 report on TA2541.

9. 16 October 2023

   Last release so far

   Version v0.5.8 is the latest release on the project page we read. Edited builds do not depend on it.

10. 2024 and 2025

    State-linked groups use custom builds

    MITRE lists a customised AsyncRAT used by APT-C-36 (Kaspersky, 19 August 2024; Check Point, March 2025; Recorded Future, 26 August 2025) and custom versions used by MirrorFace in Operation AkaiRyu, reported by ESET on 18 March 2025, where it was deployed by batch script.

11. June 2026

    Fake AI guides carry it

    FortiGuard Labs, as reported on 18 June 2026, described 7z archives posing as AI learning material, with titles such as AI-Ready PostgreSQL 18, that start a long chain of scripts and end in a .NET remote access trojan, with one branch delivering AsyncRAT.

What AsyncRAT can do on a PC

One person, from one window, controls many PCs. These are the functions the project lists and the ones MITRE and Microsoft documented. Our 2020 guide listed screenshots, keylogging, password theft, anti-analysis and installing other malware; all of them are documented. An edited build may have more or fewer.

What a hidden AsyncRAT can cost you

The risk is a person, not a program: whatever the controller decides to do. These are the documented functions turned into outcomes.

• High

  Stolen passwords, accounts and wallets

  The keylogger and password recovery read what you type and what browsers, email programs and messengers have saved, and Microsoft lists wallet files. Treat email, banking, work and crypto accounts as exposed from the day the file first ran. This is the money and identity theft that our 2020 guide warned of.

• High

  Other malware, including ransomware

  Plugins and file transfer let the controller add anything. Microsoft names ransomware deployment as a possible plugin. Our 2020 guide named Wacatac and Copa ransomware as examples; we found no source linking those two to AsyncRAT, so we keep the general risk and not the names.

• High

  Your screen, camera, microphone and files

  Screen viewing and recording, audio and video capture and the file manager show and take what is on the PC.

• Medium

  A way into the rest of your network

  Our old guide said a backdoor gives administrator permissions and lets criminals move across the network. AsyncRAT itself only checks whether the user is an administrator (MITRE). But Microsoft's advice on least privilege and on blocking PsExec and WMI is aimed at lateral movement, so on a work network tell IT before you clean anything.

• Medium

  Your connection used for someone else

  Microsoft says an infected device can become a proxy for more attacks. Our old guide went further and described botnets for spam and DDoS. Botnets are a real use of backdoors, but we found no source for AsyncRAT doing exactly that.

• Low

  Damaged Windows files

  Our old guide said serious infections can damage system files. Microsoft lists unexpected changes to system files such as the hosts file among the symptoms, but no source says AsyncRAT breaks Windows itself. Check, then reset only if you cannot be sure.

What you may notice, and why you often notice nothing

The most common sign is an alert. Microsoft's entries list the other signs, and none of them is exclusive to this threat.

Where AsyncRAT leaves traces on a PC

These come from Microsoft's two entries, Proofpoint and FortiGuard. Whoever builds a client can change names, folders and servers, so use them as places to look, not as a test that clears you.

Program file

An unexpected .exe in a user-writable folder, %AppData% or %Public% (Microsoft); the name can be anything

Startup

A scheduled task that starts it at Windows startup or log on, or a value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run (Microsoft)

Hiding in a trusted process

Microsoft says the code is injected into a legitimate .NET process such as RegSvcs.exe; Microsoft's sign is network connections from such local .NET processes to unfamiliar outside addresses

Network

An encrypted call home to a command server; Proofpoint saw addresses change about monthly and free dynamic DNS used

Delivery files

ISO files with generic names such as Document.iso or pdf.iso (Proofpoint, 2020); an archive with one shortcut and hidden PDFs (FortiGuard, 2026)

Disguised tasks

In the 2026 campaign, scheduled tasks posing as Realtek audio services and a copy of AutoHotkey renamed to look like audio components

Defender settings

The same campaign added C:\ and powershell.exe to Defender's exclusion lists

The first two names come from the two alerts in our 2020 pictures and are examples, not signs of every infection. A name from a Windows component is not proof of a clean file: check the folder it runs from.

Which name will your scanner show?

Microsoft's name for Backdoor:MSIL/AsyncRAT is Backdoor:MSIL/AsyncRAT!MTB, Backdoor:MSIL/AsyncRAT.YA!MTB and Trojan:Win32/AsyncRAT.SA.

Defender sorts threats by category first, so the word before the colon tells you what kind of program was found, even if the family name means nothing to you.

Do not search for a removal tool by the detection name alone; fake "removal tools" use the same keywords. How the naming works is explained in our guide to antivirus detection names.

How AsyncRAT gets onto a PC, and why home users are hit too

The sources we read show AsyncRAT being delivered by people, not spreading on its own across the internet (Microsoft's 2025 entry adds that it can propagate through networks once inside). Criminal groups use several routes. Our 2020 guide said it mainly targets organizations; Proofpoint's reports show messages sent to a wide range of recipients, with no industry focus, so home users are affected.

1. 1

   Phishing email with an attachment

   Phishing has been used for years and remains one of the main attack routes for the most common malware. Proofpoint saw TA2719 send ISO attachments named like Document.iso behind lures that spoofed police, banks and parcel services in local languages. MITRE also lists spearphishing attachments and users opening them.

2. 2

   Archives, shortcuts and scripts

   FortiGuard's June 2026 report describes a 7z archive named after an AI guide that holds one shortcut and hidden PDFs; opening the shortcut starts the script chain. MITRE notes that AsyncRAT has been deployed by batch script.

3. 3

   Software bundles and repacked installers

   Microsoft says infection often starts with phishing campaigns or software bundles where the payload pretends to be a legitimate file. Our 2020 guide listed repacked installers and cracks on websites pretending to be legitimate or pirated programs, which fits.

4. 4

   A second payload from another infection

   Our old guide said another backdoor can drop it, and that groups work together. A backdoor does download other malware, and Microsoft names plugins and additional payloads, but we found no report that proves this route for AsyncRAT.

5. 5

   Software flaws and open Remote Desktop

   Our old guide named unpatched software and insecure Remote Desktop connections open to the internet. None of the AsyncRAT sources we read ties it to a particular flaw or to Remote Desktop break-ins. These are real routes for other malware, so they stay in the prevention list, but we do not claim them for AsyncRAT.

Our old guide also named botnets, fake updates and web injects as ways in. We found no source for fake updates or web injects delivering AsyncRAT, so we leave them out of the list above.

Check your PC before you clean it

Our 2020 guide said to read your security software's logs first. Look first, delete later: the folder of the file and the name of its startup entry are what a helper or your IT team will want.

1. 1

   Read what your security software did

   Open Windows Security > Virus & threat protection > Protection history and open the entry. Note the threat name, the file path and whether the status says removed or quarantined. A detection can happen at any time, because the file can arrive by several routes. If another product ran, read its log too.

2. 2

   Look for leftovers

   If the log shows a component that was not removed or was blocked only, the removal is not complete. Keep a screenshot with the exact name, path and time.

3. 3

   Open Task Manager

   Press Ctrl + Shift + Esc, choose Details and look for programs you do not know. Right-click one and choose Open file location. A path under AppData, Public or Temp for a program that is not yours is more worrying than one under a program you installed.

4. 4

   Check startup apps and scheduled tasks

   In Task Manager choose Startup apps and note entries you do not know. Then press Windows logo + R, type taskschd.msc and press Enter, open Task Scheduler Library and look for tasks that start at log on with names you do not know, including ones that pose as audio or driver services.

5. 5

   Look at the Run key, without changing it

   Press Windows logo + R, type regedit, open HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and read the values. Note any that point to AppData or Public folders. Leave them until the scans are finished.

6. 6

   Check Defender's exclusions

   Open Windows Security > Virus & threat protection > Manage settings > Add or remove exclusions. Our old guide warned that malware may switch Defender off; FortiGuard's 2026 campaign added C:\ and powershell.exe to the exclusions. An exclusion you did not add is a reason to treat the PC as compromised. Also check that Real-time protection is on.

7. 7

   Look at the connections

   Open Command Prompt and run netstat -ano. An ESTABLISHED line to an address you do not know is worth noting; run tasklist /fi "PID eq 1234" with the number from the last column to see which program owns it. The server address can change, so a clean list proves nothing.

8. 8

   Ask where it came from

   A file from an email attachment, an ISO or archive, a cracked program or a download just before the first alert is the likely route. A PC at work is a case for your IT team, not for a clean-up on your own.

Remove Backdoor:MSIL/AsyncRAT from Windows 11 and Windows 10

Do the steps in order. We did not run them against a live infection; they follow Microsoft's entries and Windows support pages. Because a person may have been in control of the PC, the account steps in the next chapter are not optional.

1. 1

   Disconnect the PC from the network

   Turn off Wi-Fi and unplug the cable. Microsoft's first step is to disconnect from all networks, which also cuts the controller off. Our old guide gave the same advice. On a work network, call IT first so other PCs can be checked.

2. 2

   Change your passwords from another device

   Use a phone or another PC that has never been near the infected one. Change your email first, then banking and everything else, and turn on two-step sign-in. Microsoft says to change all passwords used or stored on the infected device from a clean one. If the PC logged your keys, new passwords typed on it go to the controller.

3. 3

   Back up documents only

   Copy documents and photos, not programs, to an external drive that you unplug afterwards. Programs and files in downloads can carry the infection.

4. 4

   Start in Safe Mode with Networking

   Open Settings > System > Recovery, click Restart now beside Advanced startup, then choose Troubleshoot > Advanced options > Startup Settings > Restart and press 5 for Safe Mode with Networking. Microsoft says it adds the network drivers you need to reach the internet. Our old guide used it so the security program cannot be interrupted if malware is tampering with it.

5. 5

   Update the definitions and run a full scan

   Open Windows Security > Virus & threat protection > Protection updates > Check for updates. Then go to Scan options, select Full scan and click Scan now. Microsoft says Defender removes threats it detects but that many infections leave remnant files and changes, and that updated definitions and a full scan might help address them. Follow what the scan finds and do not restore what it quarantines.

6. 6

   Run Microsoft Defender Offline

   In Scan options choose Microsoft Defender Offline scan and Scan now. Save your work first: Microsoft says you are signed out and Windows restarts into an isolated environment to look for persistent malware. Afterwards open Protection history to read the result.

7. 7

   Scan once with a second scanner

   Microsoft's built-in scanner may miss components, and our old guide said to scan with a second program as well. Use one on-demand scanner from a known vendor, from its own site, and do not run two with live protection at once. A second clean result still does not prove the PC is clean.

8. 8

   Delete what you found, carefully

   Microsoft's list: remove startup entries under the Run key that point to malicious files, and delete malicious tasks in Task Scheduler. Delete only what leads to a file you do not know. If you are unsure, leave it and use the reset below.

9. 9

   Update Windows and your programs

   Open Settings > Windows Update and install everything offered, and update Office, your browsers and PDF readers.

10. 10

    Reset Windows if you cannot be sure

    Our old guide said victims sometimes have to reinstall Windows, and that malware can damage Windows parts in ways security programs do not always repair. If the PC holds banking, work or private data, or the alert came back, back up documents and use Settings > System > Recovery > Reset this PC and choose Remove everything. Restore documents only.

System Restore: our old guide offered it as a second method. We did not find Microsoft or any vendor naming it for this threat, and a restore point made after the infection can bring the malware back with it. Use it only as a last step, and scan again straight after. Do not install a removal tool from a pop-up message, and never pay or call a number shown in an alert.