The first “fileless worm” on the internet plagued organizations in 2001. A new report from LevelBlue shines a spotlight on AsyncRAT, which is also anything but new and continues to cause problems without carrying any files.
LevelBlue’s SOC team has detected a fileless loader used to deploy AsyncRAT. AsyncRAT is one of the most popular examples of Malware-as-a-Service; attacks mainly target critical infrastructure in the US. It is a tool for remotely controlling devices. It disguises itself as a trusted utility and therefore regularly remains undetected. LevelBlue’s most interesting discovery is not about the malware itself, but the way it ends up on devices.
ScreenConnect
The legitimate RMM tool ScreenConnect was abused by the attackers in the incident highlighted by LevelBlue. The installation included the means to deploy AsyncRAT, but without separate files. After installing the poisoned version of ScreenConnect, a VBScript and PowerShell loader followed, which secretly ran components via external URLs. Only VBS files appeared on the disk, but the problematic consequences of this malware remained in RAM.
The payloads were loaded into the endpoint’s memory via malicious URLs. In other words, there was no file present to betray the attack. AsyncRAT’s targets were passwords and crypto wallets, so the attacker had a financial motive for the compromise.
Whenever a restart was needed for the malware, it was done via the malicious “Skype Updater,” an app that is no longer used by Microsoft. Nevertheless, this background behavior is unlikely to be a sign that something is wrong for unsuspecting users.
Encrypted
The secret reinstallation, the key to the long-term existence of this version of AsyncRAT, takes place via an encrypted string. During runtime, this is decrypted and the malware is told to reinstall itself if necessary. The normally hidden %AppData% within Windows serves as a safe hiding place.
In its report, LevelBlue manages to dissect every component of the loader and AsyncRAT. This also reveals how the attacker can be blocked. Apart from the now familiar C2 domains, behavioral patterns of the malicious ScreenConnect implementation are also known, enabling security companies to improve detection.
Read also: Memory-safe malware: Rust challenges security researchers