Loading malware…
AsyncRAT is an open-source, C#/.NET-based remote access trojan targeting Windows systems. It provides interactive remote control, command execution, file access, system-information collection, screen capture, keylogging, and data theft. Its extensible architecture allows operators to download additional plugins. Related malware families, including DcRAT and VenomRAT, derive from its codebase.
Analyzed clients record keystrokes through a low-level keyboard hook and collect host metadata, including operating-system details, usernames, privilege levels, and active-window titles. Supported operations include retrieving keylogger logs and clipboard contents, opening URLs, and modifying host configuration. Samples use AES-encrypted configuration values and validate the command-and-control server certificate against an expected hash. Configurable anti-analysis checks detect debuggers, virtualization, sandbox components, and unsuitable system characteristics. When installation is enabled, clients can relocate themselves, establish scheduled-task and registry-based persistence, and delete the original executable.
AsyncRAT is distributed through spear-phishing, malicious attachments, counterfeit software, cracked-software installers, and fake browser updates. Judicial and tax-authority impersonation lures have been used against Latin American targets, particularly in Colombia. Delivery chains frequently combine obfuscated scripts, PowerShell, AutoIT, and in-memory .NET loading. Documented chains also use DLL sideloading and process hollowing to execute the payload within trusted Windows processes. Fileless variants have been delivered through SocGholish.
AsyncRAT is used by multiple unrelated threat actors rather than belonging to a single operation. Documented users include Blind Eagle, also known as APT-C-36, and TA582-associated distribution activity. Its availability and modular functionality support both information theft and continued access to compromised systems.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
9 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2024-1708 (CWE-22) — Improper Limitation of a Pathname to a Restricted Directory (“Path Traversal”). Base CVSS score of 8.4, still considered “High Priority”.
CVE-2024-1709 (CWE-288) — Authentication Bypass Using Alternate Path or Channel. Base CVSS score of 10, indicating “Critical”.
members of the VirusTotal community have linked it to exploitation of CVE-2022-30190, a Microsoft Support Diagnostic Tool (MSDT) vulnerability also known as Follina. Threat actors have leveraged Follina to distribute malware, including the Rozena backdoor, AsyncRAT, and Qbot, which has previously delivered ransomware as a later-stage payload. | Threat actors have leveraged Follina to distribute malware, including the Rozena backdoor, AsyncRAT (remote access trojan), and Qbot, which has previously delivered ransomware as a later-stage payload.
Its most consistently used malware payloads included vjw0rm, njRAT, Revenge RAT, Loda, and AsyncRAT.
Threat Actors (TAs) leveraging a Remote Code Execution (RCE) vulnerability, identified as CVE-2023-38831, to deliver their payload on compromised systems... The aforementioned vulnerability allows the WinRAR application to extract and execute the malicious script when a user tries to open a benign file within the archive. | CRIL has recently identified and analyzed a campaign that is actively distributing various types of malware, including Apanyan Stealer, Murk-Stealer, and AsyncRAT.
Attackers relied on Microsoft Equation Editor exploit CVE-2018-0798 to deliver a custom malware that Proofpoint researchers have dubbed Cotx RAT. Additionally... the malicious RTF attachments exploited vulnerabilities in the Microsoft Equation Editor, specifically CVE-2018-0798, before downloading subsequent payloads.
"...Colombian organizations were reported by Darktrace to have been targeted by Blind Eagle in an attack campaign involving the abuse of the Windows vulnerability, tracked as CVE-2024-43451, that has been ongoing since November."
Google also observed financially motivated actors exploiting the WinRAR path-traversal flaw to distribute commodity remote access tools and information stealers such as XWorm and AsyncRAT...
The authoring agencies have identified the following open source and dual-use tools as used and/or customized by the actors: ▪ AsyncRAT
38 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Similar use of GitHub and recurring tasks appeared in Kimsuky AI phishing campaigns covered previously, although those earlier findings included AsyncRAT payloads not established for this Ukrainian attack chain.
NullBulge ... reportedly uses publicly available tools ... like Async RAT and Xworm before delivering LockBit payloads built using the leaked Lockbit builder.
On February 20, a campaign was observed which varied slightly in its deployment, and which purpose was the deployment of AsyncRat.
On February 20, a campaign was observed which varied slightly in its deployment, and which purpose was the deployment of AsyncRat.
“Multiple samples of Asyncrat were dropped and executed, probably via the Quarian backdoor.”
30 distinct techniques documented for this family, organized by ATT&CK tactic.
The TASK persistence option creates a Scheduled Task named SystemUpdate through schtasks.exe to execute at user logon.
“The final AsyncRAT payload provides attackers with remote access, including system information collection, command execution...”
The infection begins after a victim manually opens the batch file... It launches PowerShell with its window hidden.
PSE_REDIRECT_VBS decodes C2-provided VBScript, writes pse_<GUID>.vbs in %TEMP%, and executes it through wscript.exe.
The TASK persistence option creates a Scheduled Task named SystemUpdate through schtasks.exe to execute at user logon.
[PowerShell] decodes a payload using Base64 text, inserted junk characters, and XOR operations... an extensionless encrypted file... The loader decrypts its payload only in memory.
“A Blob can reassemble an archive in browser memory and hand it to the user as a download. It’s either the same smuggling technique long seen in HTML attachments, carried in something that presents as an image.”
SELFDESTRUCT deletes Run-key and scheduled-task persistence, creates a temporary batch file, deletes the malware executable, and deletes the batch file.
NETINFO enumerates active interfaces, IP addresses, MAC addresses, DNS servers, gateways, connection speed, and interface types.
NETSCAN identifies a local /24 subnet, sends ICMP pings to addresses 1–254, resolves hostnames through DNS, and reports reachable systems.
PROCLIST enumerates running processes and collects each PID, process name, memory use, and main-window title.
“The final AsyncRAT payload provides attackers with remote access, including ... Stealing...”
“The final AsyncRAT payload provides attackers with remote access, including ... Screen Capture...”
CLIPBOARD|GET reads current clipboard content using Clipboard.GetText() and sends it to C2; HVNC also supports clipboard read and write.
The implant establishes an asynchronous TcpClient connection to hardcoded C2 address 181[.]235[.]1[.]253:2404 and exchanges command and data messages.
REVERSE_PROXY establishes a TCP-based reverse proxy/tunneling mechanism over the C2 connection and forwards target traffic through a data channel.
2,346 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Open-source Windows .NET RAT whose codebase underpins DcRAT and VenomRAT. Provides remote desktop, keylogging, file access, and credential theft. Delivery includes phishing, loaders, and malvertising; listed hunting artifacts include ports 6606, 7707, and 8808 and an AsyncRAT Server certificate.
A remote access trojan found in files impersonating Copilot. The report identifies eight analyses containing this payload but provides no family-specific execution, persistence, or command-and-control details.
Remote access trojan observed in eight sandbox analyses involving files named to impersonate Copilot. The content does not describe its campaign-specific commands, persistence mechanisms, or exfiltration behavior.
Remote access trojan mentioned as a payload in previously reported Kimsuky phishing campaigns. Its deployment is not established in the Ukrainian Operation GitPower attack chain described here.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.