Threat Research

Investigating the Delivery of AsyncRAT and Infostealer Plugins via Phishing Techniques

Esentire

Short Summary:

The article discusses a recent threat investigation by eSentire’s Threat Response Unit (TRU) involving an AsyncRAT infection that originated from a phishing email. The TRU team successfully isolated and remediated the threat, highlighting the ongoing effectiveness of email as a delivery method for malware.

Key Points:

  • eSentire operates 24/7 Security Operations Centers (SOCs) staffed by elite threat hunters and cyber analysts.
  • Recent investigations revealed a phishing email that delivered AsyncRAT malware via a Windows Script File.
  • The malicious payload included a .wsf file that downloaded and executed additional scripts and batch files.
  • AsyncRAT features remote access capabilities and an info stealer plugin targeting various browsers and cryptocurrency wallet extensions.
  • The TRU team successfully contained the infection and provided recommendations for future prevention.

MITRE ATT&CK TTPs – created by AI

  • Initial Access (T1071)
    • Phishing email used to deliver malware.
  • Execution (T1203)
    • Execution of malicious scripts and batch files.
  • Persistence (T1053)
    • Creation of scheduled tasks to maintain persistence.
  • Privilege Escalation (T1068)
    • Process hollowing used to inject malicious payloads.
  • Exfiltration (T1041)
    • Data exfiltration targeting browsers and cryptocurrency wallets.

Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.

We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.

Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team.

In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward.

Here’s the latest from our TRU Team…

What did we find?

In August 2024, eSentire’s Threat Response Unit (TRU) observed an infection involving AsyncRAT stemming from the execution of a Windows Script File delivered via email. Although we could not retrieve the original email, we assess with high confidence that the malicious archive containing the payload was attached to it.

The payload is a .wsf file which uses a naming scheme that begins with “SummaryForm_” (MD5: 154cc0f462c85b494a45b7531f3a9f03). The file contains HTML character entities, as shown in Figure 1.

HTML character entities found in the malicious wsf file Exploring AsyncRAT and Infostealer Plugin Delivery Through Phishing Emails
Figure 1: HTML character entities found in the malicious wsf file

The .wsf file fetches the VBScript (Figure 2) masquerading as a text file at hxxp://104.243.37[.]35:222/bfbupdeuiterborm/uzopuzbkrpcziwca.txt (MD5: a332817fd302e05b131c7a7a0cdb1a04).

Cleaned-up .WSF file Exploring AsyncRAT and Infostealer Plugin Delivery Through Phishing Emails
Figure 2: Cleaned-up .WSF file

The VBScript does the following:

  • Uses Start-BitsTransfer to download a file from hxxp:// 104.243.37[.]35:222/bfbupdeuiterborm/lAOdPuUqwXLVFvqT.jpg. A file masquerading as an image file lAOdPuUqwXLVFvqT.jpg (MD5: c86280bd532eec707f106542a4458400) is then saved as bktpnecuahtazdbo.zip under the C:UsersPublic directory.
  • Uses Expand-Archive to extract the contents of the downloaded ZIP file into the C:UsersPublic directory.
  • Executes the VBScript file named IRUAHCKDFAFDCHUV.vbs located in the C:UsersPublic directory.
  • Deletes the bktpnecuahtazdbo.zip file to clean up traces of the initial download.

The VBS script IRUAHCKDFAFDCHUV.vbs (MD5: 1eefdb23f7c63922756eafb532127b8e) is responsible for executing the batch file CEIULUDEZFCEVSMM.bat (MD5: ac0f2aa2c5caf791f0310c2c07a1e1c3). The VBS script is also responsible for executing a PowerShell script at “C:UsersPublicYXRPNPSMGCOBEURV.ps1” in a hidden window and bypassing execution policies.

Content CEIULUDEZFCEVSMM.bat Exploring AsyncRAT and Infostealer Plugin Delivery Through Phishing Emails
Figure 3: Content CEIULUDEZFCEVSMM.bat

The PowerShell script YXRPNPSMGCOBEURV.ps1 (MD5: 315bc30cd580b750b4afc294fa38a8bc) creates a scheduled task named “MicrosoftEdgeUpdate500” on a Windows system using the Task Scheduler COM API. This task is created to run a VBS script located at C:UsersPublicWCQCMXNSFCHWESFW.vbs every 2 minutes starting from the current time. The WCQCMXNSFCHWESFW.vbs script executed the batch file “C:UsersPublicWJVIQQFZMZLSZTJJ.bat” (MD5: ec348cf15e839b8912862352bc916d22).

Content of YXRPNPSMGCOBEURV.ps1 Exploring AsyncRAT and Infostealer Plugin Delivery Through Phishing Emails
Figure 4: Content of YXRPNPSMGCOBEURV.ps1

The batch file WJVIQQFZMZLSZTJJ.bat is similar to CEIULUDEZFCEVSMM.bat, but it executes the NBUBMHCZJLEJXGVW.ps1 PowerShell script instead.

The first embedded binary “NewPE2.dll” (MD5: dcce5bc3e27295a1cbe13a411244fe93) in the script is the injector for the AsyncRAT payload. Specifically, it performs process hollowing on the RegAsm.exe process.

The strings referencing the APIs used for process injection are obfuscated by replacing specified placeholders with binary digits, reversing the order, filtering out non-binary characters, and then interpreting them as ASCII characters (Figure 5).

String obfuscation Exploring AsyncRAT and Infostealer Plugin Delivery Through Phishing Emails
Figure 5: String obfuscation

You can find the configuration for AsyncRAT here. This version of AsyncRAT also comes with the infostealer plugin. The RAT looks for the following browsers to exfiltrate the data from:

  • Opera
  • OperaGX
  • Firefox
  • Chrome
  • Brave
  • Firefox
  • Edge

And the following cryptowallet browser extensions:

  • nkbihfbeogaeaoehlefnkodbefgpgknn (MetaMask)
  • bfnaelmomeimhlpmgjnjophhpkkoljpa (Phantom)
  • fhbohimaelbohpjbbldcngcnapndodjp (Binance)
  • ibnejdfjmmkpcnlpebklmnkoeoihofec (TronLink)
  • jiidiaalihmmhddjgbnbgdfflelocpak (Bitget Wallet)
  • hnfanknocfeofbddgcijnmhnfnkdnaad (Coinbase)
  • fnjhmkhhmkbjkkabndcnnogagogbneec (Ronin Wallet)
  • egjidjbpglichdcondbcbdnbeeppgdph (Trust Wallet)
  • jkjgekcefbkpogohigkgooodolhdgcda (BitPay)
  • acmacodkjbdgmoleebolmdjonilkdbch (Rabby Wallet)
  • ejbalbakoplchlghecdalmeeeajnimhm (MetaMask)

The following application extensions:

  • bhghoamapcdpbohphigoooaddinpkbai (Authenticator 2FA)
  • ocglkepbibnalbgmbachknglpdipeoio (Authenticator 2FA)

In conclusion, email continues to be a popular method for delivering malware, as shown in this case involving AsyncRAT infection, which not only facilitates remote access but also features information-stealing capabilities.

What did we do?

  • Our team of 24/7 SOC Cyber Analysts isolated the affected host to contain the infection, remediated the threat, and returned the host to service.

What can you learn from this TRU Positive?

  • The initial vector for the AsyncRAT infection was a phishing email, showcasing that this method still remains an effective way for attackers to deliver malware.
  • AsyncRAT provides attackers with remote access capabilities and includes an info stealer plugin. The plugin targets various browsers and cryptocurrency wallet extensions.

Recommendations from the Threat Response Unit (TRU):

Indicators of Compromise

You can access the Indicators of Compromise here.

References

Source: Original Post

Tags: LEARN, SOC, BROWSER, WINDOWS, PHISHING, EMAIL, INITIAL ACCESS, PERSISTENCE