AsyncRAT loader: Obfuscation, DGAs, decoys and Govno

Executive summary

AT&T Alien Labs has identified a campaign to deliver AsyncRAT onto unsuspecting victim systems. During at least 11 months, this threat actor has been working on delivering the RAT through an initial JavaScript file, embedded in a phishing page. After more than 300 samples and over 100 domains later, the threat actor is persistent in their intentions.

Key takeaways:

• The victims and their companies are carefully selected to broaden the impact of the campaign. Some of the identified …

actor alien amp asyncrat campaign decoys dgas domains embedded executive file javascript labs loader obfuscation page phishing rat systems threat threat actor victim working