AsyncRAT is one of the most used open-source remote access tools. It is a C# .NET program with screen viewing and recording, keylogging, antivirus checks and anti-analysis features. Several actors, including those tracked as TA2719 and TA2541, have used it.
Reading the configuration
The program waits a few seconds on start so a quick sandbox run looks like a failure, then runs InitializeSettings. Every setting is encrypted with AES-256 and wrapped in base64. A key derivation routine (Rfc2898DeriveBytes, 50,000 iterations) produces two values from the master key and a salt: a 32-byte AES key and a 64-byte value used with HMAC-SHA256 to check that the data has not been altered.
port 6666
host <attacker domain>
version 1.5 (crypter version also visible)
install true / false
mutex AsyncMutex_<random>
pastebin null
anti-analysis true / false
bdos true / false
group default or a campaign label (one was "new campaign" in Portuguese with a date)
hwid derived from processor count, user, machine name, OS, system dir size -> MD5, first 10 chars
server cert self-signed "AsyncRAT Server", valid until the year 9999
The server certificate is checked by comparing an RSA signature against a stored value, so the client only talks to a server it knows.
Anti-analysis checks
manufacturer / model Microsoft with "Virtual", VMware or VirtualBox
debugger remote debugger attached
sandbox SbieDll.dll present (Sandboxie)
disk size small disk (about 57 GB or less)
operating system Windows XP
Staying power
admin run : scheduled task
standard run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run -> copy in %APPDATA%
helper : .bat in %APPDATA% waits with timeout, starts the copy, deletes itself
critical : RtlSetProcessIsCritical when admin and BDOS set -> killing it crashes Windows
no sleep : SetThreadExecutionState keeps the machine awake; another thread watches idle time
It can also list installed antivirus products, then connect over TCP after discarding stale packets, and download extra payloads from Pastebin or another URL.
Delivery over the years
Mar 2023 OneNote phishing
Oct 2023 HTML smuggling
Feb 2024 undetected PDF -> link to a zip on GitHub -> BAT -> PowerShell -> cmd ->
PowerShell adds an exclusion -> downloads the AsyncRAT exe (also on GitHub)
Jun 2024 drive-by download
2025 LNK -> WebDAV request to a trycloudflare URL -> payload; Python-based loaders
ongoing JS, WSF, PS1, VBS attachments in mass phishing (for example Italian booking/invoice lures)
Behaviour worth a rule
- An LNK that starts a WebDAV request to a trycloudflare.com address.
- PowerShell that adds a Defender exclusion path and then downloads an executable.
- Encoded or obfuscated command lines launched from script files.