Analysis of AsyncRAT Campaign

AsyncRAT (Asynchronous Remote Access Trojan) is a type of malicious software designed to give attackers remote control over an infected computer. Unlike other types of malware that require constant communication with the attacker’s system, AsyncRAT operates asynchronously, meaning it can send and receive data without needing a continuous connection. 

What AsyncRAT actually do: 

● Remote Control: It allows cybercriminals to control the infected system, enabling them to execute commands, access files, and even take screenshots. 

● Data Theft: AsyncRAT can steal sensitive information, such as login credentials, personal files, or confidential data. 

● Keylogging: The malware may include keylogging features to capture the victim's keystrokes, potentially revealing passwords and other private details. 

● Persistence: Even after restarting the system, AsyncRAT can remain active, giving attackers ongoing access to the machine. 

● Stealth: The Trojan is often designed to be hidden from security software and system monitoring tools, making it difficult to detect. 

Infection Chain: 

The infection process begins with a PowerShell script, which is initially delivered in a base64-encoded format. This encoding is used to evade detection by security tools and filters. Once the script is decoded and executed, it performs a series of actions: 

Stage 1: PowerShell (.PS1) Script 

Stage 2: Batch (.bat) File 

Stage 3: MSIL (.Net) Framework

Initial Vector PowerShell (.PS1) Script: 

PowerShell is often used in attacks because it is a powerful scripting language built into Windows, allowing attackers to execute commands without needing additional malware. Its ability to run base64-encoded scripts helps bypass detection and evade traditional security measures. 

The PowerShell script is delivered in a base64-encoded format to bypass detection systems. Upon execution, the script decodes itself back into its original form, which contains instructions to drop additional files onto the system. 

Hard-Coded PowerShell Script: 

Hard-Coded Batch Script:

Dropped DOS batch File: 

Once decoded, the PowerShell script proceeds to drop a batch script (.bat file) onto the infected system. The batch file contains specific commands that are designed to be executed automatically upon execution. 

The batch script is triggered by the PowerShell script and runs without user interaction. This batch script is responsible for executing further actions, such as making changes to system settings or preparing the system for the next stage of the attack. 

Payload .NET Executable: 

One of the primary functions of the batch script is to download a malicious payload from a remote server or location. This can be an executable file that will compromise the system. The payload may be malware, ransomware, or another type of malicious software, depending on the attacker's objective. 

"LoadOP" refers to a type of malware or trojan designed to load additional malicious payloads onto an infected system. It acts as a loader or dropper, enabling the delivery and execution of further malware after compromising the target system. Cybercriminals often use such tools to bypass security defenses by

first deploying a small, less detectable payload (like LoadOP), which then downloads or loads more damaging malicious software. 

Embedded Windows API Strings: 

LoadLibraryA is a Windows function that loads a DLL into a process's memory, allowing the application to access the functions within that DLL. 

On the other hand, "LoadAPI" is a broader term referring to the technique of dynamically loading external APIs or code. While not a specific Windows function, it is used in both legitimate software and malicious activities. Malicious software often exploits functions like LoadLibraryA to inject harmful code or load malicious DLLs into legitimate processes, which is why these terms are frequently discussed in malware analysis.

Indicator of Compromise (IOCs): 

Indicators of Compromise (IOCs) are forensic data points used to identify potential security breaches or malicious activity, such as IP addresses, file hashes, or suspicious URLs. They help detect, investigate, and respond to cyber threats.

MITRE Attack Framework: 

ID	Tactic	Technique
TA0001	Initial Access	Spam Email Phishing Attachment (.ps1)
TA0002	Execution	Windows Scripting (.bat)  Native APIs
TA0003	Persistence	DLL Side Loading  Logon Initialization Scripts  Windows Services (.net)
TA0004	Privilege Escalation	Process Injection  DLL Side Loading
TA0005	Defense Evasion	Disable or Modify Tools  Virtualization/Sandbox Evasion  Process Injection  DLL Side Loading
TA0007	Discovery	Security Software Discovery  System Information Discovery  Application Window Discovery  Virtualization/Sandbox Evasion
TA0009	Collection	Archive Collected Data
TA00010	C&C Server	Encrypted Channel  Non-Standard Port Ingress Tool Transfer  Non-Application Layer Protocol

Post by

newWorld