AsyncRAT Persistence via MasterPackager.Updater Scheduled Task by RegAsm.exe

Ethan Andrews@eandrews

•updated Jul 1, 2026•1•0•1

Detects the creation of a 'MasterPackager.Updater' scheduled task by a suspicious instance of RegAsm.exe (hollowed process). The task is configured to execute a VBScript located in C:\Users\Public every two minutes, a known tactic associated with AsyncRAT delivery chains.