AsyncRAT Leverages Fileless Techniques to Bypass Detection

AsyncRAT is revealed in a case study of a multi-stage fileless loader that uses legitimate system tools to deploy the Remote Access Trojan without leaving a footprint on disk. The intrusion began via a compromised ScreenConnect client, with access gained through the malicious domain relay.shipperzone[.]online, allowing remote control of the target endpoint.

A VBScript Update.vbs run by WScript then triggered a PowerShell command to fetch two payloads, logs[.]ldk and logs[.]ldr, from a remote server and write them to C:\Users\Public\; instead of executing from disk, logs[.]ldk was turned into a byte array and logs[.]ldr was loaded directly into memory via reflection.

The first stage loads Obfuscator.dll, an in-memory launcher that establishes persistence by a scheduled task disguised as “Skype Updater” and includes anti-analysis routines such as PatchAMSI() and PatchETW().

The second stage, AsyncClient.exe, decrypts its configuration to reveal C2 endpoints (3osch20[.]duckdns[.]org), targets a directory, and a hardware ID, then communicates via a 4-byte length-prefixed MessagePack heartbeat and transmits encrypted exfiltrated data, including keystrokes and clipboard contents, back to the C2. The report highlights the need for memory-forensic monitoring and strict whitelisting to counter such fileless campaigns.