Tuesday, June 18, 2024

AsyncRAT Malware Attacking the US Infrastructure for 11 Months

AsyncRAT is an open-source remote access Trojan (RAT) malware known for its ability to provide unauthorized access and control over infected systems. It was released in 2019. 

Hackers use it actively for various malicious purposes, including:-

  • Data theft
  • System manipulation
  • Surveillance
  • Cyber espionage
  • Keylogging
  • Exfiltration techniques
  • Initial access staging for final payload delivery

Cybersecurity researchers at AT&T recently discovered that AsyncRAT malware has been actively attacking the US infrastructure for 11 months.

AsyncRAT Malware

APT Earth Berberoka has used this RAT, and recently, AT&T Alien Labs noted a phishing spike in September targeting individuals with gif attachments leading to:-

  • SVG file
  • Obfuscated JavaScript
  • PowerShell scripts
  • AsyncRAT execution
Number of samples observed (Source - AT&T)
Number of samples observed (Source – AT&T)

The loader’s stages are obfuscated by the C&C server that checks the victim for sandbox before deploying the AsyncRAT payload. C&C redirects to a harmless page when parameters are not met. 

JavaScript files delivered via phishing with obfuscated strings like:-

  • Melville
  • church
  • chapter
  • Scottish

Meanwhile, the loader versions vary for each victim with randomized variable names, constants, and URL representation. After the GET request, C&C sends base64 script XOR’ed against a hardcoded key, unpacked with Gunzip, and executed flawlessly in PowerShell.

Execution flow (Source - AT&T)
Execution flow (Source – AT&T)

The C&C values like 1b (VM False) are correct, while 2c (VMWare) and other wrong answers have higher values. C&C may have a table of valid responses or a value range that helps in avoiding brute force.

Anti-sandboxing technique evades popular sandboxes. Invalid answer redirects to Google or returns a new script reaching out to payload in temp[.]sh with $url variable. 

However, besides this, the temp[.]sh link is consistent across samples and time, which helps in hosting the files for three days with new randomized URL paths.

The code dynamically changes and is heavily obfuscated for detection evasion, but network infrastructure remains consistent. 

The samples use a variety of domains that are frequently updated, and among them, the common domains include:-

  • sduyvzep[.]top
  • orivzije[.]top
  • zpeifujz[.]top

Here below, we have mentioned all the characteristics that are followed by the domain structure:-

  • Top Level Domain (TLD): top
  • 8 random alphanumeric characters
  • Registrant organization: ‘Nicenic.net, Inc’ (the registrar)
  • Country code South Africa (ZA)
  • Created a few days before its use

The Domain Generation Algorithm (DGA) calculates a unique domain every seven days and on every Sunday, it generates a new one. 

The seed, which is derived from the day of the year, undergoes modifications for variation that includes changes to other variables and characters in the scripts. 

This strategy helps threat actors avoid detection and blocking by automatically changing the C&C domain over time.

IOCs

IoCs (Source - AT&T)
IoCs (Source – AT&T)
Website

Latest articles

Singapore Police Arrested Two Individuals Involved in Hacking Android Devices

The Singapore Police Force (SPF) has arrested two men, aged 26 and 47, for...

CISA Conducts First-Ever Tabletop Exercise Focused on AI Cyber Incident Response

On June 13, 2024, the Cybersecurity and Infrastructure Security Agency (CISA) made history by...

Europol Taken Down 13 Websites Linked to Terrorist Operations

Europol and law enforcement agencies from ten countries have taken down 13 websites linked...

New ARM ‘TIKTAG’ Attack Impacts Google Chrome, Linux Systems

Memory corruption lets attackers hijack control flow, execute code, elevate privileges, and leak data.ARM's...

Operation Celestial Force Employing Android And Windows Malware To Attack Indian Users

A Pakistani threat actor group, Cosmic Leopard, has been conducting a multi-year cyber espionage...

Hunt3r Kill3rs Group claims they Infiltrated Schneider Electric Systems in Germany

The notorious cybercriminal group Hunt3r Kill3rs has claimed responsibility for infiltrating Schneider Electric's systems...

Hackers Employing New Techniques To Attack Docker API

Attackers behind Spinning YARN launched a new cryptojacking campaign targeting publicly exposed Docker Engine...
Tushar Subhra Dutta
Tushar Subhra Dutta
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles