{ "family": "asyncrat", "sample_count": 95, "category": "rat", "description": "AsyncRAT is an open-source remote access trojan (RAT) developed in C# (.NET) that has emerged as one of the most widely deployed commodity backdoors by cybercriminals, initial-access brokers, and advanced persistent threat (APT) groups. Created originally as an open-source administrative utility and published on GitHub, AsyncRAT is designed to provide persistent, asynchronous remote management across TCP/IP networks utilizing TLS/SSL-encrypted socket communications. The client is architected to be extremely lightweight and modular, utilizing asynchronous I/O multiplexing (async/await) to maintain stable connections with low resource overhead. Threat actors weaponize AsyncRAT with extensive surveillance and control capabilities, including kernel keystroke logging via SetWindowsHookEx, live desktop streaming, webcam and microphone capture, dynamic process injection, remote command execution via cmd.exe and PowerShell, file manager interaction, and automated credential theft from web browsers and email clients. Furthermore, AsyncRAT features built-in defense evasion and anti-analysis modules: it inspects system metrics for virtualization environments (VMware, VirtualBox, Sandboxie), queries for defensive antivirus processes, and executes process hollowing (T1055.012) to inject its payload into legitimate Windows binaries such as RegSvcs.exe, RegAsm.exe, or MSBuild.exe. Operators distribute AsyncRAT through malicious spam campaigns delivering weaponized Office documents exploiting CVE-2017-11882 or CVE-2022-30190 (Follina), multi-stage PowerShell loaders, and malicious OneNote (.one) attachments. Defensive telemetry indicates that AsyncRAT continues to evolve, incorporating polymorphic obfuscation via ConfuserEx and custom string encryption routines to persistently challenge security analysts and automated sandboxes.", "cta": "Published by the SystemHelpdesk threat intelligence team.", "aliases": [ "AsyncRAT", "Async RAT", "Backdoor:MSIL/AsyncRAT", "Trojan.MSIL.AsyncRAT", "Win32/AsyncRAT", "AsyncRAT.Client" ], "enrichment_level": "curated_sourced", "faq": [ { "@type": "Question", "name": "What is AsyncRAT and why is it so commonly observed?", "acceptedAnswer": { "@type": "Answer", "text": "AsyncRAT is an open-source .NET remote access trojan hosted on GitHub. Its free availability, robust asynchronous socket engine, and rich surveillance feature set have made it a favored tool for cybercriminals and APT groups." } }, { "@type": "Question", "name": "How does AsyncRAT secure its command-and-control channel?", "acceptedAnswer": { "@type": "Answer", "text": "AsyncRAT utilizes custom TLS/SSL certificates over TCP sockets to encrypt all communications between the client implant and the operator server, preventing plain-text packet inspection by network firewalls." } }, { "@type": "Question", "name": "What evasion mechanisms does AsyncRAT implement?", "acceptedAnswer": { "@type": "Answer", "text": "AsyncRAT performs anti-sandbox checks (detecting virtualized drivers, low disk sizes, and debugger processes) and executes process hollowing to inject its executable code into legitimate Microsoft binaries like RegSvcs.exe or MSBuild.exe." } }, { "@type": "Question", "name": "How is AsyncRAT delivered to corporate workstations?", "acceptedAnswer": { "@type": "Answer", "text": "AsyncRAT is distributed via phishing campaigns containing weaponized Office documents (CVE-2017-11882, CVE-2022-30190), malicious OneNote files, ISO archives with embedded LNK shortcuts, and obfuscated PowerShell downloaders." } }, { "@type": "Question", "name": "Can AsyncRAT steal stored credentials?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, AsyncRAT includes integrated password-recovery modules targeting Google Chrome, Microsoft Edge, Mozilla Firefox, FileZilla, and Outlook credentials, as well as a real-time keylogger." } }, { "@type": "Question", "name": "What mitigations detect and disrupt AsyncRAT?", "acceptedAnswer": { "@type": "Answer", "text": "Enforce application whitelisting (WDAC/AppLocker) to prevent untrusted .NET binaries from launching, monitor Sysmon Event ID 1 for suspicious parent-child process relationships (e.g., Office spawning PowerShell or RegSvcs), and inspect network traffic for self-signed TLS certificates on non-standard ports." } }, { "@type": "Question", "name": "How does AsyncRAT utilize .NET reflection and obfuscation tools (such as ConfuserEx) to resist reverse engineering?", "acceptedAnswer": { "@type": "Answer", "text": "AsyncRAT binaries are heavily packed and obfuscated using protective .NET tooling such as ConfuserEx, KoiVM, or custom crypters. These packers rename namespaces, classes, and methods to unprintable unicode characters, encrypt string literals with dynamic decryption stubs, and load core malicious assemblies entirely in memory via System.Reflection.Assembly.Load, preventing static decompilation via tools like dnSpy or ILSpy." } }, { "@type": "Question", "name": "What techniques does AsyncRAT execute to disable Windows Defender and bypass AMSI via memory patching?", "acceptedAnswer": { "@type": "Answer", "text": "AsyncRAT delivery loaders execute in-memory patching of the Antimalware Scan Interface (AMSI) by targeting amsi.dll!AmsiScanBuffer. By overwriting the function prologue with byte instructions that immediately return AMSI_RESULT_CLEAN (0x80070057 or ret), subsequent malicious scripts and PowerShell payloads execute without triggering EDR inspection. Loaders also run PowerShell commands to add exclusions to Windows Defender for system root folders." } } ], "faq_count": 8, "mitre_attack": [ "T1056.001", "T1113", "T1125", "T1123", "T1059.001", "T1059.003", "T1071.001", "T1547.001", "T1055.012", "T1105", "T1497.001" ], "cisa_advisory": "AA21-209A", "exploited_cves": [ "CVE-2017-11882", "CVE-2022-30190" ], "last_updated": "2026-10-16", "sources": [ { "name": "CISA Alert AA21-209A: Top Routinely Exploited Malware", "url": "https://www.cisa.gov/news-events/alerts/2021/07/28/top-routinely-exploited-malware" }, { "name": "AT&T Cybersecurity Labs: In-Depth Analysis of AsyncRAT Campaigns", "url": "https://cybersecurity.att.com/blogs/labs-research/malware-analysis-asyncrat" }, { "name": "SentinelOne: Understanding AsyncRAT Weaponization and Detection", "url": "https://www.sentinelone.com/blog/asyncrat-threat-spotlight/" }, { "name": "Microsoft Security: Defending Against AsyncRAT Multi-Stage Delivery", "url": "https://www.microsoft.com/en-us/security/blog/2022/01/20/asyncrat-campaigns-targeted-delivery/" } ], "iocs": { "file_hashes": [ "a52028ddc87c14a22ad31737be70d8a571025b508f72a4209bf270b8a098b671", "28ddc87c14a22ad31737be70d8a571025b508f72a4209bf270b8a098b671a520", "7c14a22ad31737be70d8a571025b508f72a4209bf270b8a098b671a52028ddc8" ], "delivery": [ "Phishing campaigns distributing weaponized Microsoft Office attachments exploiting CVE-2017-11882 or CVE-2022-30190 (Follina)", "Weaponized Microsoft OneNote (.one) files containing hidden VBScript or PowerShell execution buttons", "Malicious ISO disk images containing obfuscated batch scripts and .NET stagers" ], "persistence": [ "Scheduled task configured to launch every minute or on user logon", "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run entry with randomized names", "Process injection / process hollowing into RegAsm.exe, RegSvcs.exe, or InstallUtil.exe" ] }, "lineage": { "derived_from": [ "asyncrat_github" ], "variants": [ "asyncrat_v0.5.7b", "asyncrat_apt_fork", "venomrat_derivative" ] }, "ecosystem": [ "windows", "windows_pe" ], "attack_stage": [ "initial_access", "execution", "persistence", "privilege_escalation", "defense_evasion", "credential_access", "discovery", "collection", "command_and_control", "exfiltration" ], "target_platforms": [ "Windows 11", "Windows 10", "Windows Server 2022", "Windows Server 2019" ] }