Malware

PhishingRAT

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

21 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

4 techniques

T1053.005Scheduled TaskEvidence2

MITRE ATT&CK Mapping ... Persistence Scheduled Task/Job T1053.005 "WindowsUpdate" (logon) + "CryptoMiner" (1-min)

T1059.001PowerShellEvidence1

Name: CryptoMiner | Trigger: every minute | Action: powershell miner.ps1

T1059.003Windows Command ShellEvidence1

MITRE ATT&CK Mapping ... Execution Command and Scripting Interpreter T1059.003 cmd.exe /c for persistence scripts

T1204User ExecutionEvidence1

MITRE ATT&CK Mapping ... Execution User Execution T1204 Social engineering via RobloxHack/Spotify lures

Persistence

2 techniques

T1053.005Scheduled TaskEvidence2

MITRE ATT&CK Mapping ... Persistence Scheduled Task/Job T1053.005 "WindowsUpdate" (logon) + "CryptoMiner" (1-min)

T1547.001Registry Run Keys / Startup FolderEvidence2

Persistence Registry Run Keys T1547.001 HKLM\...\CurrentVersion\Run\WindowsUpdate --> %AppData%\AsyncRAT.exe

Privilege Escalation

2 techniques

T1053.005Scheduled TaskEvidence2

MITRE ATT&CK Mapping ... Persistence Scheduled Task/Job T1053.005 "WindowsUpdate" (logon) + "CryptoMiner" (1-min)

T1547.001Registry Run Keys / Startup FolderEvidence2

Persistence Registry Run Keys T1547.001 HKLM\...\CurrentVersion\Run\WindowsUpdate --> %AppData%\AsyncRAT.exe

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence2

MITRE ATT&CK Mapping ... Defense Evasion Obfuscated Files or Information T1027 Base64-encoded config, reversed registry strings

T1036.005Match Legitimate Resource Name or LocationEvidence1

Defense Evasion Masquerading T1036.005 Installs as AsyncRAT.exe under generic "WindowsUpdate" name

T1497Virtualization/Sandbox EvasionEvidence1

MITRE ATT&CK Mapping ... Defense Evasion Virtualization/Sandbox Evasion T1497 VM drivers, debugger, WMI, process checks

T1497.001System ChecksEvidence1

Defense Evasion Virtualization/Sandbox Evasion T1497.001 VMware, VirtualBox, Sandboxie, WMI manufacturer checks

Credential Access

1 technique

T1056.001KeyloggingEvidence2

Collection Input Capture: Keylogging T1056.001 Keyboard capture module

Discovery

4 techniques

T1046Network Service DiscoveryEvidence1

7. Port scanning simulation High-volume probes across multiple ports. This triggers network scanning detection rules and adds volume to PCAP files.

T1082System Information DiscoveryEvidence2

MITRE ATT&CK Mapping ... Discovery System Information Discovery T1082 OS, hardware, AV, admin status, HWID

T1497Virtualization/Sandbox EvasionEvidence1

MITRE ATT&CK Mapping ... Defense Evasion Virtualization/Sandbox Evasion T1497 VM drivers, debugger, WMI, process checks

T1497.001System ChecksEvidence1

Defense Evasion Virtualization/Sandbox Evasion T1497.001 VMware, VirtualBox, Sandboxie, WMI manufacturer checks

Collection

2 techniques

T1056.001KeyloggingEvidence2

Collection Input Capture: Keylogging T1056.001 Keyboard capture module

T1113Screen CaptureEvidence1

MITRE ATT&CK Mapping ... Collection Screen Capture T1113 System.Drawing screenshot capability

Command and Control

4 techniques

T1071.001Web ProtocolsEvidence2

Command and Control Web Protocols T1071.001 HTTPS to Cloudflare-proxied domains on ports 443/80

T1132.001Standard EncodingEvidence1

MITRE ATT&CK Mapping ... Command and Control Data Encoding T1132.001 MessagePack binary serialization

T1573.001Symmetric CryptographyEvidence1

Command and Control Encrypted Channel T1573.001 AES-256-CBC with HMAC-SHA256 for C2 communication

T1573.002Asymmetric CryptographyEvidence1

MITRE ATT&CK Mapping ... Command and Control Encrypted Channel T1573.002 AES-256/PBKDF2 + X509 + HMAC over TLS 1.3

Impact

3 techniques

T1486Data Encrypted for ImpactEvidence1

10. Fake ransomware activity Simulates file encryption with a hardcoded key.

T1496Resource HijackingEvidence1

Impact Resource Hijacking T1496 CryptoMiner scheduled task (noise generator, but real system impact)

T1498.001Direct Network FloodEvidence1

MITRE ATT&CK Mapping ... Impact Network Denial of Service T1498.001 HTTP flood/DDoS against arbitrary targets

Other

1 technique

T1562.001Disable or Modify ToolsEvidence2

Defense Evasion Impair Defenses T1562.001 Windows Defender disabled via registry modification

INDICATORS OF COMPROMISE

IOCs tracked for this family

27 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

9 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

18 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app5 months ago

hash.sha1●●●●●●●●●●●●View more in app5 months ago

hash.sha256●●●●●●●●●●●●View more in app5 months ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

breakglass intelNews

Mar 12, 2026

AsyncRAT "PhishingRAT" Variant: Vietnamese Operator Leaks Full Dev Path While Building a Sandbox Confusion Engine That Floods Analysts With Fake Exploits - Breakglass Intelligence - Breakglass Intelligence

A modified AsyncRAT variant that provides remote access and persistence, communicates over TLS with encrypted MessagePack-based C2 traffic, and adds a sandbox confusion engine that generates fake malicious behaviors to poison analysis reports. The sample also includes HTTP flood/DDoS capability, aggressive persistence, Defender disabling, and process-critical protection.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching27

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping21

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

PhishingRAT

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

21 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

4 techniques

T1053.005Scheduled TaskEvidence2

MITRE ATT&CK Mapping ... Persistence Scheduled Task/Job T1053.005 "WindowsUpdate" (logon) + "CryptoMiner" (1-min)

T1059.001PowerShellEvidence1

Name: CryptoMiner | Trigger: every minute | Action: powershell miner.ps1

T1059.003Windows Command ShellEvidence1

MITRE ATT&CK Mapping ... Execution Command and Scripting Interpreter T1059.003 cmd.exe /c for persistence scripts

T1204User ExecutionEvidence1

MITRE ATT&CK Mapping ... Execution User Execution T1204 Social engineering via RobloxHack/Spotify lures

Persistence

2 techniques

T1053.005Scheduled TaskEvidence2

MITRE ATT&CK Mapping ... Persistence Scheduled Task/Job T1053.005 "WindowsUpdate" (logon) + "CryptoMiner" (1-min)

T1547.001Registry Run Keys / Startup FolderEvidence2

Persistence Registry Run Keys T1547.001 HKLM\...\CurrentVersion\Run\WindowsUpdate --> %AppData%\AsyncRAT.exe

Privilege Escalation

2 techniques

T1053.005Scheduled TaskEvidence2

MITRE ATT&CK Mapping ... Persistence Scheduled Task/Job T1053.005 "WindowsUpdate" (logon) + "CryptoMiner" (1-min)

T1547.001Registry Run Keys / Startup FolderEvidence2

Persistence Registry Run Keys T1547.001 HKLM\...\CurrentVersion\Run\WindowsUpdate --> %AppData%\AsyncRAT.exe

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence2

MITRE ATT&CK Mapping ... Defense Evasion Obfuscated Files or Information T1027 Base64-encoded config, reversed registry strings

T1036.005Match Legitimate Resource Name or LocationEvidence1

Defense Evasion Masquerading T1036.005 Installs as AsyncRAT.exe under generic "WindowsUpdate" name

T1497Virtualization/Sandbox EvasionEvidence1

MITRE ATT&CK Mapping ... Defense Evasion Virtualization/Sandbox Evasion T1497 VM drivers, debugger, WMI, process checks

T1497.001System ChecksEvidence1

Defense Evasion Virtualization/Sandbox Evasion T1497.001 VMware, VirtualBox, Sandboxie, WMI manufacturer checks

Credential Access

1 technique

T1056.001KeyloggingEvidence2

Collection Input Capture: Keylogging T1056.001 Keyboard capture module

Discovery

4 techniques

T1046Network Service DiscoveryEvidence1

7. Port scanning simulation High-volume probes across multiple ports. This triggers network scanning detection rules and adds volume to PCAP files.

T1082System Information DiscoveryEvidence2

MITRE ATT&CK Mapping ... Discovery System Information Discovery T1082 OS, hardware, AV, admin status, HWID

T1497Virtualization/Sandbox EvasionEvidence1

MITRE ATT&CK Mapping ... Defense Evasion Virtualization/Sandbox Evasion T1497 VM drivers, debugger, WMI, process checks

T1497.001System ChecksEvidence1

Defense Evasion Virtualization/Sandbox Evasion T1497.001 VMware, VirtualBox, Sandboxie, WMI manufacturer checks

Collection

2 techniques

T1056.001KeyloggingEvidence2

Collection Input Capture: Keylogging T1056.001 Keyboard capture module

T1113Screen CaptureEvidence1

MITRE ATT&CK Mapping ... Collection Screen Capture T1113 System.Drawing screenshot capability

Command and Control

4 techniques

T1071.001Web ProtocolsEvidence2

Command and Control Web Protocols T1071.001 HTTPS to Cloudflare-proxied domains on ports 443/80

T1132.001Standard EncodingEvidence1

MITRE ATT&CK Mapping ... Command and Control Data Encoding T1132.001 MessagePack binary serialization

T1573.001Symmetric CryptographyEvidence1

Command and Control Encrypted Channel T1573.001 AES-256-CBC with HMAC-SHA256 for C2 communication

T1573.002Asymmetric CryptographyEvidence1

MITRE ATT&CK Mapping ... Command and Control Encrypted Channel T1573.002 AES-256/PBKDF2 + X509 + HMAC over TLS 1.3

Impact

3 techniques

T1486Data Encrypted for ImpactEvidence1

10. Fake ransomware activity Simulates file encryption with a hardcoded key.

T1496Resource HijackingEvidence1

Impact Resource Hijacking T1496 CryptoMiner scheduled task (noise generator, but real system impact)

T1498.001Direct Network FloodEvidence1

MITRE ATT&CK Mapping ... Impact Network Denial of Service T1498.001 HTTP flood/DDoS against arbitrary targets

Other

1 technique

T1562.001Disable or Modify ToolsEvidence2

Defense Evasion Impair Defenses T1562.001 Windows Defender disabled via registry modification

INDICATORS OF COMPROMISE

IOCs tracked for this family

27 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

9 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

18 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app5 months ago

hash.sha1●●●●●●●●●●●●View more in app5 months ago

hash.sha256●●●●●●●●●●●●View more in app5 months ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

breakglass intelNews

Mar 12, 2026

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching27

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping21

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.