AsyncRAT Distributed via WSF Script

The AhnLab Security Emergency response Center (ASEC) analysis team previously posted about AsyncRAT being distributed via files with the .chm extension. [1] It was recently discovered that this type of AsyncRAT malware is now being distributed in WSF script format. The WSF file was found to be distributed in a compressed file (.zip) format through URLs contained within emails.

[Download URLs]
1. https://*****************.com.br/Pay5baea1WP7.zip
2. https://************.za.com/Order_ed333c91f0fd.zip
3. https://*************.com/PAY37846wp.zip
4. https://*****.****.co/eBills37890913.zip

Decompressing the first downloaded zip file yields a file with a …

basic comments download extension file image link malware analysis run script tag visual basic wsf zip