AsyncRAT is a five-stage infection chain that begins with a socially engineered batch file, Right-click to open Invoice a batch script. The batch file launches PowerShell with a hidden window and disables the profile before executing a a script payload script. It drops three files into an obfuscated build-specific folder under a renamed but legitimate signed AutoIT interpreter, an AutoIT loader script (a malicious file), and an extensionless encrypted payload.
The AutoIT script builds every API name and string at runtime from XOR-encoded integer lists, decrypts the payload in memory with a single-byte key, and injects it a malicious executable via the standard OpenProcess → VirtualAllocEx → WriteProcessMemory → CreateRemoteThread chain. Successive stages decrypt to a final AsyncRAT DLL (a malicious library) with screen capture and information stealing functionality.[/subscribe_to_unlock_form]
AsyncRAT is a five-stage infection chain that begins with a socially engineered batch file, Right-click to open Invoice a batch script. The batch file launches PowerShell with a hidden window and disables the profile before executing a a script payload script. It drops three files into an obfuscated build-specific folder under a renamed but legitimate signed AutoIT interpreter, an AutoIT loader script (a malicious file), and an extensionless encrypted payload.
The AutoIT script builds every API name and string at runtime from XOR-encoded integer lists, decrypts the payload in memory with a single-byte key, and injects it a malicious executable via the standard OpenProcess → VirtualAllocEx → WriteProcessMemory → CreateRemoteThread chain. Successive stages decrypt to a final AsyncRAT DLL (a malicious library) with screen capture and information stealing functionality.[emaillocker id="1283"]
The infection chain begins with phishing emails or malicious links that trick users into opening malware, which downloads a batch file that executes PowerShell with a hidden window and disables the profile before executing a a script payload script. The payload is delivered through AutoIT scripts that decrypt and inject the final AsyncRAT DLL into a malicious executable.
| Tactic | Technique Id | Technique | Sub-technique |
|---|---|---|---|
| Initial access | T1566.001 | Phishing | Spearphishing Attachment |
| Execution | T1059.003 | Command and Scripting Interpreter | Windows Command Shell |
| Execution | T1204.002 | User Execution | Malicious File |
| Persistence | T1547.001 | Boot or Logon Autostart Execution | Registry Run Keys / Startup Folder |
| Defence Evasion | T1055.002 | Process Injection | Portable Executable Injection |
| Defence Evasion | T1140 | Deobfuscate/Decode Files or Information | - |
| Discovery | T1082 | System Information Discovery | - |
| Collection | T1113 | Screen Capture | - |
| Command and control | T1071.001 | Application Layer Protocol | Web Protocols |
| Exfiltration | T1041 | Exfiltration Over C2 Channel | - |
| Objective | Behavior ID | Behavior |
|---|---|---|
| Anti-Static Analysis | B0032 | Executable Code Obfuscation |
| Anti-Behavioral Analysis | B0003 | Dynamic Analysis Evasion |
| Defense Evasion | B0029 | Polymorphic Code |
| Execution | E1204 | User Execution |
| Persistence | F0012 | Registry Run Keys / Startup Folder |
| Defense Evasion | E1055 | Process Injection |
| Command & Control | B0030 | C2 Communication |
| Discovery | E1083 | File and Directory Discovery |
| Exfiltration | E1020 | Automated Exfiltration |
The following reports contain further technical details:
[/emaillocker]