Executive Summary
Point Wild Threat Intelligence has identified a sophisticated multi-stage delivery mechanism for AsyncRAT. The infection begins with a socially engineered batch file that utilizes PowerShell to reassemble and decode a multi-fragmented Base64 payload. This process drops a legitimate, signed AutoIT interpreter along with an obfuscated loader script to handle subsequent stages of the attack, effectively bypassing traditional signature-based security tools.
The technical execution involves high levels of obfuscation, including repeating-key XOR and runtime API string construction. The final AsyncRAT payload is injected into a legitimate Microsoft-signed process (charmap.exe) using a standard process injection chain (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread). This allows the malware to perform credential theft and screen captures under the guise of a trusted Windows process.
This campaign highlights the continued trend of using 'living off the land' binaries and legitimate interpreters to mask malicious activity. Organizations should focus on monitoring for unusual PowerShell activity, unexpected batch files in Startup folders, and unauthorized process injections into common Windows utilities.