Loading malware…
AsyncRAT is an open-source remote access trojan for Windows first released in 2019 that has since spawned numerous forks, custom builds, and heavily modified variants used across cybercrime and espionage operations. It is commonly deployed as a .NET-based implant and is frequently delivered through multi-stage loaders, phishing and adversary-in-the-middle campaigns, ClickFix social-engineering chains, malicious archives and shortcut files, steganographic droppers, trojanized software components, and DLL sideloading or reflective in-memory loading. Operators have also used it in watering-hole activity and through compromised public-facing portals masquerading as legitimate updates or security software components.
AsyncRAT provides interactive remote access and is routinely used for hands-on-keyboard post-compromise activity. Observed capabilities include persistence, host reconnaissance, credential theft, keylogging, screenshot capture, clipboard monitoring, webcam and audio capture, remote desktop functionality, process injection, AMSI bypass or tampering, Windows Defender evasion, and in some variants Hidden VNC for banking fraud. More advanced customized builds have added Windows Notification Facility-based injection, browser profile cloning, Chrome App-Bound Encryption bypass techniques, Hidden RDP, UAC bypass methods, and fallback process hollowing. Campaigns have also shown AsyncRAT being loaded reflectively into memory, injected into legitimate processes, or paired with other implants to provide redundant command channels.
The malware is used by a wide range of actors rather than a single cluster. Reported users include commodity cybercriminal operators, phishing crews, and state-linked or espionage-oriented groups. Documented associations include Blind Eagle, which used a materially upgraded AsyncRAT variant with banking-fraud-oriented enhancements; MirrorFace, which deployed a heavily customized version alongside other backdoors; operators tied to ClickFix ecosystems; UAC-0173 targeting Ukrainian organizations; and activity affecting Pakistani law-enforcement systems in which an AsyncRAT client was embedded in a fake update component. AsyncRAT has also appeared in large-scale malicious GitHub and software supply-chain distribution operations as a downstream payload.
Victimology is correspondingly broad. AsyncRAT has been observed against enterprises, government and law-enforcement entities, universities, corporate users, and general Windows users across multiple regions. Its continued prevalence is driven by public source availability, ease of customization, compatibility with common loader tradecraft, and a broad feature set that supports both commodity intrusion workflows and more specialized espionage or fraud operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Attackers relied on Microsoft Equation Editor exploit CVE-2018-0798 to deliver a custom malware that Proofpoint researchers have dubbed Cotx RAT. Additionally... the malicious RTF attachments exploited vulnerabilities in the Microsoft Equation Editor, specifically CVE-2018-0798, before downloading subsequent payloads.
"...Colombian organizations were reported by Darktrace to have been targeted by Blind Eagle in an attack campaign involving the abuse of the Windows vulnerability, tracked as CVE-2024-43451, that has been ongoing since November."
Google also observed financially motivated actors exploiting the WinRAR path-traversal flaw to distribute commodity remote access tools and information stealers such as XWorm and AsyncRAT...
The authoring agencies have identified the following open source and dual-use tools as used and/or customized by the actors: ▪ AsyncRAT
21 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
a materially upgraded AsyncRAT build, internally codenamed JC-46, that introduces Windows Notification Facility (WNF) process injection, a custom Base28 payload encoding, a full Hidden VNC (HVNC) banking-fraud module with browser profile cloning, and a Chrome App-Bound Encryption (ABE) v20 bypass.
The group also deploys HiddenFace (aka NOOPDOOR), a modular backdoor observed only in MirrorFace operations, alongside a heavily customised version of AsyncRAT for additional control.
AsyncRAT est un cheval de Troie d’accès distant (RAT) open-source pour Windows, publié en janvier 2019 par le développeur NYAN-x-CAT sur GitHub. Il constitue la racine d’une famille de malwares ayant engendré environ 40 variants nommés à travers trois générations de forks successifs.
AsyncRAT in Action: UAC-0173’s Latest Advanced Antivirus Detection & Evasion Techniques
AsyncRAT est un cheval de Troie d’accès distant (RAT) open-source pour Windows, publié en janvier 2019 par le développeur NYAN-x-CAT sur GitHub. Il constitue la racine d’une famille de malwares ayant engendré environ 40 variants nommés à travers trois générations de forks successifs.
39 distinct techniques documented for this family, organized by ATT&CK tactic.
The China-nexus threat actor is also said to have compromised one of these web applications to deploy a custom implant masquerading as a portal update.
These three families use entirely different outer obfuscation... yet the decoded stage-2 logic that installs persistence is functionally and, in places, literally identical... Scheduled task name Photo Studio
two small VBScript downloaders (System3.vbs, System5.vbs, roughly 790 bytes each) simply shell out to PowerShell to fetch two files from raw.githubusercontent.com and chain them together.
These three families use entirely different outer obfuscation... yet the decoded stage-2 logic that installs persistence is functionally and, in places, literally identical... Scheduled task name Photo Studio
Hidden RDP (HRDP) Creates a hidden local admin account excluded from the login screen
These three families use entirely different outer obfuscation... yet the decoded stage-2 logic that installs persistence is functionally and, in places, literally identical... Scheduled task name Photo Studio
a materially upgraded AsyncRAT build, internally codenamed JC-46, that introduces Windows Notification Facility (WNF) process injection
From there, an AES-256-ECB-encrypted PowerShell payload compiles inline C# via Add-Type and performs process hollowing into RegSvcs.exe
Client1.exe implements a working bypass for ABE v20 – escalating to SYSTEM via Winlogon token impersonation
before spawning the hollowing target, the script builds an extended STARTUPINFOEX attribute list with PROC_THREAD_ATTRIBUTE_PARENT_PROCESS... classic parent-process-ID spoofing
Four developments stood out during this collection window: a third distinct string-obfuscation scheme... a materially upgraded AsyncRAT build...
Pixels to Payload: Dissecting a Four-Stage Bitmap-Steganography Dropper Delivering AsyncRAT
the decoded output runs via ExecuteGlobal and reveals a clean, legible stage-2 script whose real purpose is disguised behind a fake photo-viewer identity – the same “Photo Studio” cover story
a materially upgraded AsyncRAT build, internally codenamed JC-46, that introduces Windows Notification Facility (WNF) process injection
From there, an AES-256-ECB-encrypted PowerShell payload compiles inline C# via Add-Type and performs process hollowing into RegSvcs.exe
build a random %TEMP% folder, assemble an AES decryption stub in memory, execute it, and delete the evidence.
Client1.exe implements a working bypass for ABE v20 – escalating to SYSTEM via Winlogon token impersonation
before spawning the hollowing target, the script builds an extended STARTUPINFOEX attribute list with PROC_THREAD_ATTRIBUTE_PARENT_PROCESS... classic parent-process-ID spoofing
The reassembled stream is then fed into a genuinely custom decoder: a stateful cipher combining a running XOR accumulator, a small per-build rotation table, and an 8-bit rotate-right-by-3 operation
High-value detections include wscript.exe or cscript.exe spawning PowerShell, followed by execution of rarely used Microsoft binaries such as RegSvcs.exe, MSBuild.exe, jsc.exe, or AppLaunch.exe
Category Capabilities Surveillance Keylogger; screenshot streaming; HVNC hidden desktop; webcam live stream
the RAT pauses the victim’s real browser process just long enough to copy its Chromium profile (cookies, Login Data, Local State, Web Data) into a clone directory
Reconnaissance WMI hardware/OS fingerprint; geo-IP lookup; AV product enumeration; hardware ID hashing; local /24 ICMP sweep
Category Capabilities Surveillance Keylogger; screenshot streaming; HVNC hidden desktop; webcam live stream
Category Capabilities Surveillance Keylogger; screenshot streaming; HVNC hidden desktop
1,096 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
RAT observé comme payload livré via ClickFix.
Remote access trojan delivered via a four-stage bitmap-steganography dropper.
A heavily customized remote access trojan used by Blind Eagle for banking fraud, featuring WNF-based injection, HVNC, browser profile cloning, credential theft, hidden RDP, multiple UAC bypasses, and a Chrome ABE v20 bypass.
Remote access trojan used with the botnet name MaDOOOOOOOO_Work and communicating with C2 at 83.136.211.85:7077.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.