Saturday, March 2, 2024

AsyncRAT Malware Attacking the US Infrastructure for 11 Months

AsyncRAT is an open-source remote access Trojan (RAT) malware known for its ability to provide unauthorized access and control over infected systems. It was released in 2019. 

Hackers use it actively for various malicious purposes, including:-

  • Data theft
  • System manipulation
  • Surveillance
  • Cyber espionage
  • Keylogging
  • Exfiltration techniques
  • Initial access staging for final payload delivery

Cybersecurity researchers at AT&T recently discovered that AsyncRAT malware has been actively attacking the US infrastructure for 11 months.

AsyncRAT Malware

APT Earth Berberoka has used this RAT, and recently, AT&T Alien Labs noted a phishing spike in September targeting individuals with gif attachments leading to:-

  • SVG file
  • Obfuscated JavaScript
  • PowerShell scripts
  • AsyncRAT execution
Number of samples observed (Source - AT&T)
Number of samples observed (Source – AT&T)

The loader’s stages are obfuscated by the C&C server that checks the victim for sandbox before deploying the AsyncRAT payload. C&C redirects to a harmless page when parameters are not met. 

JavaScript files delivered via phishing with obfuscated strings like:-

  • Melville
  • church
  • chapter
  • Scottish

Meanwhile, the loader versions vary for each victim with randomized variable names, constants, and URL representation. After the GET request, C&C sends base64 script XOR’ed against a hardcoded key, unpacked with Gunzip, and executed flawlessly in PowerShell.

Execution flow (Source - AT&T)
Execution flow (Source – AT&T)

The C&C values like 1b (VM False) are correct, while 2c (VMWare) and other wrong answers have higher values. C&C may have a table of valid responses or a value range that helps in avoiding brute force.

Anti-sandboxing technique evades popular sandboxes. Invalid answer redirects to Google or returns a new script reaching out to payload in temp[.]sh with $url variable. 

However, besides this, the temp[.]sh link is consistent across samples and time, which helps in hosting the files for three days with new randomized URL paths.

The code dynamically changes and is heavily obfuscated for detection evasion, but network infrastructure remains consistent. 

The samples use a variety of domains that are frequently updated, and among them, the common domains include:-

  • sduyvzep[.]top
  • orivzije[.]top
  • zpeifujz[.]top

Here below, we have mentioned all the characteristics that are followed by the domain structure:-

  • Top Level Domain (TLD): top
  • 8 random alphanumeric characters
  • Registrant organization: ‘Nicenic.net, Inc’ (the registrar)
  • Country code South Africa (ZA)
  • Created a few days before its use

The Domain Generation Algorithm (DGA) calculates a unique domain every seven days and on every Sunday, it generates a new one. 

The seed, which is derived from the day of the year, undergoes modifications for variation that includes changes to other variables and characters in the scripts. 

This strategy helps threat actors avoid detection and blocking by automatically changing the C&C domain over time.

IOCs

IoCs (Source - AT&T)
IoCs (Source – AT&T)
Website

Latest articles

AI Worm Developed by Researchers Spreads Automatically Between AI Agents

Researchers have developed what they claim to be one of the first generative AI...

20 Million+ Cutout.Pro User Records Leaked On Hacking Forums

CutOut.Pro, an AI-powered photo and video editing platform, has reportedly suffered a data breach,...

CWE Version 4.14 Released: What’s New!

The Common Weakness Enumeration (CWE) project, a cornerstone in the cybersecurity landscape, has unveiled...

RisePro Stealer Attacks Windows Users Steals Sensitive Data

A new wave of cyber threats has emerged as the RisePro information stealer targets...

Golden Corral Restaurant Chain Hacked: 180,000+ Users’ Data Stolen

The Golden Corral Corporation, a popular American restaurant chain, has suffered a significant data...

CISA Warns Of Hackers Exploiting Multiple Flaws In Ivanti VPN

Threat actors target and abuse VPN flaws because VPNs are often used to secure...

BEAST AI Jailbreak Language Models Within 1 Minute With High Accuracy

Malicious hackers sometimes jailbreak language models (LMs) to exploit bugs in the systems so...
Tushar Subhra Dutta
Tushar Subhra Dutta
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles