AsyncRAT Technical Intelligence Dossier

Executive Summary & Threat Architecture

AsyncRAT is an open-source remote access trojan (RAT) developed in C# (.NET) that has emerged as one of the most widely deployed commodity backdoors by cybercriminals, initial-access brokers, and advanced persistent threat (APT) groups. Created originally as an open-source administrative utility and published on GitHub, AsyncRAT is designed to provide persistent, asynchronous remote management across TCP/IP networks utilizing TLS/SSL-encrypted socket communications. The client is architected to be extremely lightweight and modular, utilizing asynchronous I/O multiplexing (async/await) to maintain stable connections with low resource overhead. Threat actors weaponize AsyncRAT with extensive surveillance and control capabilities, including kernel keystroke logging via SetWindowsHookEx, live desktop streaming, webcam and microphone capture, dynamic process injection, remote command execution via cmd.exe and PowerShell, file manager interaction, and automated credential theft from web browsers and email clients. Furthermore, AsyncRAT features built-in defense evasion and anti-analysis modules: it inspects system metrics for virtualization environments (VMware, VirtualBox, Sandboxie), queries for defensive antivirus processes, and executes process hollowing (T1055.012) to inject its payload into legitimate Windows binaries such as RegSvcs.exe, RegAsm.exe, or MSBuild.exe. Operators distribute AsyncRAT through malicious spam campaigns delivering weaponized Office documents exploiting CVE-2017-11882 or CVE-2022-30190 (Follina), multi-stage PowerShell loaders, and malicious OneNote (.one) attachments. Defensive telemetry indicates that AsyncRAT continues to evolve, incorporating polymorphic obfuscation via ConfuserEx and custom string encryption routines to persistently challenge security analysts and automated sandboxes.

Observed Threat Aliases: AsyncRAT, Async RAT, Backdoor:MSIL/AsyncRAT, Trojan.MSIL.AsyncRAT, Win32/AsyncRAT, AsyncRAT.Client

Ancestry & Lineage Tracking

Derived From / Upstream Ancestry: asyncrat_github

Documented Downstream Variants: asyncrat_v0.5.7b, asyncrat_apt_fork, venomrat_derivative

Weaponized Vulnerabilities & Exploitation Topology

Documented common vulnerabilities and exposures (CVEs) weaponized by AsyncRAT operators for initial execution, sandbox evasion, or SYSTEM-level kernel privilege escalation:

→ Explore all 77 exploited vulnerabilities on the SystemHelpDesk CVE Threat Matrix Hub.

MITRE ATT&CK® Tactical Tradecraft

Tactics, techniques, and procedures (TTPs) systematically mapped across real-world intrusion kill-chains:

→ Inspect the complete 226-technique matrix on the MITRE ATT&CK Defense Hub.

Indicators of Compromise (IOCs) & Forensic Artifacts

Curated indicators for retrospective threat hunting across SIEM and EDR platforms:

Initial Delivery Vectors

• Phishing campaigns distributing weaponized Microsoft Office attachments exploiting CVE-2017-11882 or CVE-2022-30190 (Follina)
• Weaponized Microsoft OneNote (.one) files containing hidden VBScript or PowerShell execution buttons
• Malicious ISO disk images containing obfuscated batch scripts and .NET stagers

Host Persistence & Execution Hooks

• Scheduled task configured to launch every minute or on user logon
• HKCU\Software\Microsoft\Windows\CurrentVersion\Run entry with randomized names
• Process injection / process hollowing into RegAsm.exe, RegSvcs.exe, or InstallUtil.exe

Reference File Hashes (SHA-256)

• a52028ddc87c14a22ad31737be70d8a571025b508f72a4209bf270b8a098b671
• 28ddc87c14a22ad31737be70d8a571025b508f72a4209bf270b8a098b671a520
• 7c14a22ad31737be70d8a571025b508f72a4209bf270b8a098b671a52028ddc8