zeek-asyncrat-detector

Zeek ベースの AsyncRAT マルウェア検出器 マルウェアは、そのコマンド＆コントロール（C2）サーバーとの通信をHTTPS上に隠すことがよくあります。 HTTPSの暗号化により、マルウェアは通常、その目的を達成するのに十分な期間、侵害を隠蔽します。そのため、HTTPSを使用するマルウェアの検出は困難ですが、今回のAsyncRATのように、時には幸運な突破口が得られることもあります。AsyncRATは、過去1年間に米国の重要インフラを管理する組織を標的として展開されてきたWindowsリモートアクセスツールです。 Notice.log 出力の例 root@kitploit:...

AsyncRAT-C-Sharp

AsyncRAT AsyncRATは、安全な暗号化接続を介して他のコンピュータをリモートで監視および制御するために設計されたリモートアクセスツール（RAT）です。 含まれるプロジェクト このプロジェクトには以下が含まれます コマンドを送受信するプラグインシステム クライアントを制御するためのアクセスターミナル ターミナルから管理可能な設定可能なクライアント すべての重要なイベントを記録するログサーバー 含まれる機能： クライアント画面ビューア＆レコーダー クライアントウイルス対策＆整合性マネージャー アップロードとダウンロードを含むクライアントSFTPアクセス...

Asyncrat-Venom-Dcrat-Config-Extractor

Asyncrat-Venom-Dcrat-Config-Extractor Asyncrat/Dcrat/VenomRat 用の静的 Config 抽出器 dnlib を使用して、暗号化された Config データと関連する暗号化値を特定します。 値はマルウェアコードをエミュレートまたは実行することなく、スクリプト内で復号化されます。 設定が Client.Settings クラスの下にあることを前提とします 設定が base64 でエンコードされ、AES256 で暗号化されていることを前提とします ファイルの大部分がほぼ難読化されていないことを前提とします Aes256 Salt...

CVE-2024-4577-Exploitation-AsyncRAT-Deployment-DFIR-Investigation

CVE-2024-4577 Indagine DFIR su AsyncRAT...

The SOC Files: ScreenConnect masked as freeware. An inside look at a large-scale campaign

UPD 03.07.2026: added a package of rules and recommendations that help detect the described malicious activity for companies using our Kaspersky SIEM system. Introduction To access compromised systems, threat actors frequently abuse legitimate remote monitoring tools. At first glance, these...

Hackers Use Fake Claude Code Guide and AI PDFs to Spread AsyncRAT Malware

Hackers are using fake Claude Code guide and AI PDFs to spread AsyncRAT malware via Windows attack using PowerShell and Defender exclusions...

Open the wrong “PDF” and attackers gain remote access to your PC

Cybercriminals behind a campaign dubbed DEADVAX are taking phishing one step further by delivering malware inside virtual hard disks that pretend to be ordinary PDF documents. Open the wrong “invoice” or “purchase order” and you won't see a document at all. Instead, Windows mounts a virtual drive...

AsyncRAT Exploits ConnectWise ScreenConnect to Steal Credentials and Crypto

Cybersecurity researchers have disclosed details of a new campaign that leverages ConnectWise ScreenConnect, a legitimate Remote Monitoring and Management RMM software, to deliver a fleshless loader that drops a remote access trojan RAT called AsyncRAT to steal sensitive data from compromised...

New Fileless Malware Attack Uses AsyncRAT for Credential Theft

LevelBlue Labs reports AsyncRAT delivered through a fileless attack chain using ScreenConnect, enabling credential theft and persistence...

Hackers Using New QuirkyLoader Malware to Spread Agent Tesla, AsyncRAT and Snake Keylogger

Cybersecurity researchers have disclosed details of a new malware loader called QuirkyLoader that's being used to deliver via email spam campaigns an array of next-stage payloads ranging from information stealers to remote access trojans since November 2024. Some of the notable malware families...

GodRAT – New RAT targeting financial institutions

Summary In September 2024, we detected malicious activity targeting financial trading and brokerage firms through the distribution of malicious .scr screen saver files disguised as financial documents via Skype messenger. The threat actor deployed a newly identified Remote Access Trojan RAT named...

AsyncRAT's Open-Source Code Sparks Surge in Dangerous Malware Variants Across the Globe

Cybersecurity researchers have charted the evolution of a widely used remote access trojan called AsyncRAT , which was first released on GitHub in January 2019 and has since served as the foundation for several other variants. "AsyncRAT has cemented its place as a cornerstone of modern malware an...

A week in security (June 1 – June 7)

Last week on Malwarebytes Labs: What does Facebook know about me? Lock and Code S06E11 Victims risk AsyncRAT infection after being redirected to fake Booking.com sites Juice jacking warnings are back, with a new twist The North Face warns customers about potentially stolen data Scammers are...

Victims risk AsyncRAT infection after being redirected to fake Booking.com sites

Cybercriminals have started a campaign of redirecting links placed on gaming sites and social media—and as sponsored ads—that lead to fake websites posing as Booking.com. According to Malwarebytes research, 40% of people book travel through a general online search, creating a lot of opportunities...

Booking.com Phishing Scam Uses Fake CAPTCHA to Install AsyncRAT

Fake Booking.com emails trick hotel staff into running AsyncRAT malware via fake CAPTCHA, targeting systems with remote access…...

China-Linked MirrorFace Deploys ANEL and AsyncRAT in New Cyber Espionage Operation

Threat hunters have shed more light on a previously disclosed malware campaign undertaken by the China-aligned MirrorFace threat actor that targeted a diplomatic organization in the European Union with a backdoor known as ANEL. The attack, detected by ESET in late August 2024, singled out a Centr...

Desert Dexter Targets 900 Victims Using Facebook Ads and Telegram Malware Links

The Middle East and North Africa have become the target of a new campaign that delivers a modified version of a known malware called AsyncRAT since September 2024. "The campaign, which leverages social media to distribute malware, is tied to the region's current geopolitical climate," Positive...

AsyncRAT Campaign Uses Python Payloads and TryCloudflare Tunnels for Stealth Attacks

A malware campaign has been observed delivering a remote access trojan RAT named AsyncRAT by making use of Python payloads and TryCloudflare tunnels. "AsyncRAT is a remote access trojan RAT that exploits the async/await pattern for efficient, asynchronous communication," Forcepoint X-Labs...

A Bag of RATs: VenomRAT vs. AsyncRAT

Introduction Remote access tools RATs have long been a favorite tool for cyber attackers, since they enable remote control over compromised systems and facilitate data theft, espionage, and continuous monitoring of victims. Among the well-known RATs are VenomRAT and AsyncRAT. These are open-sourc...

SocGholish Malware Exploits BOINC Project for Covert Cyberattacks

The JavaScript downloader malware known as SocGholish aka FakeUpdates is being used to deliver a remote access trojan called AsyncRAT as well as a legitimate open-source project called BOINC. BOINC, short for Berkeley Open Infrastructure Network Computing Client, is an open-source "volunteer...