đŠ Malware Analysis
===================
đŻ Threat Intelligence
Executive summary: Recent investigations reveal a repeatable campaign where attackers abuse ConnectWise ScreenConnect installers hosted in open directories to distribute AsyncRAT and a custom PowerShell RAT.
The campaign combines trusted RMM footprints, ClickOnce pivots and payload containers that evade signature-based detection.
Technical details:
âą Observed payloads include AsyncRAT and a bespoke PowerShell RAT delivered alongside trojanized ScreenConnect installers.
âą Infrastructure enumeration identified multiple hosts (examples:
176.65.139.119, 45.74.16.71, 164.68.120.30) and repeated file names such as logs.ldk, logs.idk, logs.idr ranging from ~60 KB to 3 MB.
âą Execution techniques show two distinct code paths: in-memory .NET Assembly.Load for AVâguarded environments and native injection via libPK.dll::Execute otherwise.
âą Persistence mechanisms include scheduled tasks named SystemInstallTask and 3losh with aggressive intervals (every 2â10 minutes).
âą Network/C2 tradecraft spans common ports (21/80/111/443) and high ephemeral ranges (30,000â60,000), often wrapped in TLS.
đč Attack Chain Analysis
âą Initial Access / Phishing: ClickOnce pivots (e.g., police.html â galusa.ac.mz â dual.saltuta.com) delivering a launcher from /Bin/ paths.
âą Download: Trojanized ScreenConnect installer retrieved from open directory hosting.
âą Execution: Dual paths â Assembly.Load into memory or libPK.dll native injection.
âą Persistence: Creation of scheduled tasks with short recurrence.
âą C2 / Telemetry: AsyncRAT beaconing over standard and ephemeral ports with TLS.
Impact & analysis: Abusing legitimate RMM installers introduces supplyâchainâlike risk; trusted installer footprints lower detection fidelity and enable long dwell times. Fresh or repackaged containers missing from VirusTotal indicate active reâuse and rapid churn.
Detection guidance:
âą Monitor for creation of scheduled tasks named SystemInstallTask/3losh and unusual recurrence intervals.
âą Alert on processes performing .NET Assembly.Load from nonstandard locations and on native DLLs named libPK.dll performing injection-like behaviors.
âą Hunt for open directory listings exposing logs.ldk|logs.idk|logs.idr and ClickOnce /Bin/ URL patterns.
Mitigations:
âą Harden RMM deployment processes, restrict installer hosting and validate installer hashes.
âą Block or monitor suspicious open directory access and implement strict egress controls for ephemeral port ranges.
âą Enforce application allowlisting and endpoint behavioral detections for in-memory assembly loads and DLL injection.
đč AsyncRAT #ScreenConnect #ClickOnce #RMM #C2
đ Source: https://hunt.io/blog/asyncrat-screenconnect-open-directory-campaigns
CyberVeille.ch
hasamba
The DefendOps Diaries
Alvin Ashcraft đżïž
Miha MarkiÄ
susie
WinFuture.de