AsyncRAT Uses Fileless Loader to Bypass Detections and Gain Remote Access

EXECUTIVE SUMMARY:

The fileless malware, particularly in the case of AsyncRAT, a Remote Access Trojan known for its stealth and adaptability. Unlike traditional malware, which leaves behind executable traces on disk, fileless malware operates directly in memory, making detection and remediation far more difficult for defenders. The investigated campaign illustrates this through the abuse of legitimate remote access software, specifically a trojanized ScreenConnect installer. The attackers gained initial access and then executed a layered chain of malicious scripts, including VBScript and PowerShell loaders, designed to fetch obfuscated .NET assemblies from external infrastructure. These components eventually unpacked into AsyncRAT, while maintaining persistence via a fake “Skype Updater” scheduled task that disguised itself as a legitimate system process. This approach allowed the attackers to leverage trusted utilities such as WScript and PowerShell, blending their activities with normal system behavior.[emaillocker id="1283"]

The technical breakdown reveals AsyncRAT’s complexity and layered defense evasion. The initial VBScript dropper, Update.vbs, invoked PowerShell to fetch encoded payloads, which were loaded directly into memory through reflection. These stages demonstrated classic fileless execution, decoding obfuscated data on the fly and avoiding disk writes. Analysis with dnSpy showed that logs ldk, compiled into Obfuscator dll, reconstructed persistence mechanisms by generating further scripts and registering scheduled tasks under deceptive names like “Skype Updater.” Functions within the Obfuscator class implemented critical defense bypasses, including AMSI and ETW patching, disabling runtime scanning and telemetry logging. From there, logs ldr expanded into AsyncClient exe, the fully featured AsyncRAT payload. This binary contained namespaces for client-server communication, encryption routines, plugin handling, and surveillance modules. It included AES-256 encrypted configuration data, decrypted at runtime using PBKDF2-derived keys, demonstrating advanced use of cryptography to conceal infrastructure and execution flags. AsyncClient maintained persistence by installing itself in controlled directories, creating scheduled tasks or registry keys depending on privilege levels, and relaunching via batch files to erase artifacts. Its networking component established SSL-encrypted C2 communication with hardcoded or dynamically resolved domains, exchanging commands encoded with MessagePack. Reconnaissance modules scanned for cryptocurrency wallets in browsers and desktop apps, while LimeLogger enabled keystroke logging with contextual metadata such as window titles. The command dispatcher supported credential theft, clipboard hijacking, antivirus disabling, and execution of dynamically loaded plugins. This modularity allowed AsyncRAT to adapt during an infection, extending capabilities on demand while maintaining stealth and persistence.

AsyncRAT’s architecture and its implications for defenders through a combination of obfuscation, encryption, and modular plugin-based design, the malware achieves a resilient foothold that resists static detection and complicates forensic analysis. Key observations included the use of AES-256 encrypted configuration values, reflection-based fileless execution, and C2 communication secured with SSL and structured through MessagePack. These elements illustrate how AsyncRAT operators prioritize stealth, persistence, and adaptability. From a defensive perspective, reverse engineering this campaign provides actionable intelligence such as hardcoded keys, domains, and behavioral patterns, which can be leveraged for retrospective detection and threat hunting. More importantly, the investigation highlights broader lessons for enterprise security: adversaries are increasingly relying on fileless techniques, abusing trusted administrative tools, and targeting emerging assets such as cryptocurrency wallets alongside traditional credentials. To counter such threats, organizations must enhance endpoint visibility, monitor for anomalous script execution, and deploy defenses that detect in-memory activity rather than relying solely on file-based signatures.

THREAT PROFILE:

MBC MAPPING:

REFERENCES:

The following reports contain further technical details:

• https://cybersecuritynews.com/asyncrat-uses-fileless-loader/
• https://levelblue.com/blogs/security-essentials/asyncrat-in-action-fileless-malware-techniques-and-analysis-of-a-remote-access-trojan