Quartet of Trouble: XWorm, AsyncRAT, VenomRAT, and...

Description

eSentire's Threat Response Unit (TRU) uncovered a malware campaign affecting a government customer. The infection involved multiple threats - XWorm, VenomRAT, PureLogs Stealer, and AsyncRAT - hosted on a TryCloudflare WebDAV server. The initial vector was a phishing email with a malicious ZIP file. The attack employed obfuscated batch and encrypted Python scripts to deploy the RATs, utilizing techniques like direct syscalls, shellcode decryption, and Early Bird APC queue injection to evade detection.