AsyncRAT

AsyncRAT is a form of malware, malicious software designed to exploit and damage computer systems. It infiltrates systems through suspicious downloads, emails, or websites, often unbeknownst to the user. Once installed, it can steal personal information, disrupt operations, or even hold data hostage for ransom. In recent events, the SocGholish malware was used as a vehicle to spread AsyncRAT. After an executable loads http_dll.dll, the DLL unpacks in memory, subsequently loading the AsyncRAT malware. This strategy makes detection and removal of the malware particularly challenging. The latest version of AsyncRAT includes an infostealer plugin designed to exfiltrate data from popular web browsers like Chrome and Firefox, as well as cryptocurrency wallet extensions such as MetaMask and Coinbase. This functionality enables the malware to steal sensitive user data from these applications. The scripts created by the malware establish a scheduled task to execute the AsyncRAT payload repeatedly, further complicating its detection and removal. On August 29, 2024, eSentire's Threat Response Unit (TRU) discovered an AsyncRAT infection that was delivered through a Windows Script File (.wsf) via email. These tactics include using publicly available Remote Access Trojans (RATs) like njRAT and AsyncRAT, which are customized for espionage or financial theft. The group known as BlindEagle has been observed running operations using njRAT, LimeRAT, BitRAT, and AsyncRAT, among others, indicating a broad usage of RATs in cyber-espionage activities.