Distribution of AsyncRAT Disguised as Ebook
July 10, 2024, 9:29 a.m.
Description
This analysis covers the distribution of AsyncRAT malware disguised as an ebook. The compressed file contains a malicious LNK and PowerShell scripts that ultimately execute AsyncRAT. The malware employs various techniques, such as obfuscation, task scheduling, and anti-VM and anti-AV capabilities, to maintain persistence and exfiltrate user information while receiving commands from the threat actor. Particular caution is advised due to the potential for widespread distribution via phishing emails and file-sharing websites.
Tags
Date
- Created: July 10, 2024, 9:22 a.m.
- Published: July 10, 2024, 9:22 a.m.
- Modified: July 10, 2024, 9:29 a.m.
Indicators
- b8f1fe93386003e82a148e0efd52759bc3be7bc7088537f6d031faec54870fb3
- a562909c5c9b7b8c20484cd0822e2c379d36a34432ef11306bf1e1f28762aeb6
- https://worldofprocure.com/worldofprocure.rar
- stevenhead.ddns.net
- worldofprocure.com
Attack Patterns
- AsyncRAT
- T1064
- T1059.005
- T1059.001
- T1548
- T1059.007
- T1497
- T1070
- T1057
- T1083
- T1569
- T1036
- T1027