Async RAT Malware: A Dual Comprehensive Malware Analysis & Threat Intelligence Report

Executive Summary

This report presents detailed analysis of a malicious software sample AsyncRAT. This malware is known for its sophisticated Remote Access Trojan (RAT), and exhibits advanced techniques designed to compromise a host system, maintain persistence, and facilitate unauthorized data access and exfiltration.

The process analysis of this malware revealed that its initial execution was through Windows command shell (cmd.exe), which triggered a secondary batch script (tmpF14C.tmp.bat) responsible for coordinating subsequent malicious actions.

In its ablility to evade detection, the malware masquerades as a legitimate Google Update process (GoogleUpdate.exe). It deployed itself within the user’s Roaming directory (C:\Users\admin\AppData\Roaming), initiated benign network activity that mimic legitimate behavior and conducted system recoinnaissance simultenously.

Overall, the analysis of the malware identified an active command-and-control (C2) framework connected to a suspicious domain bdkb0.ru.com. It established an encrypted communications using both conventional ports (HTTPS/443) and commonly abused non-standard ports (8808, 5555). Although some initial C2 connection attempts resulted to HTTP error, which suggests possible security tools interferance or misconfiguration.

The execution of this malware generated significant network activity, including numerous HTTP requests, TCP sessions, and DNS which were flagged as malicious by the automated sandbox. Overall, the observed behavior is consistent with a modular, persistence-focused RAT engineered for long-term access, representing a critical risk to affected organizations.

AsyncRAT Remote Access Trojan (RAT)

This project documents a full static and dynamic analysis of a Windows malware sample identified as AsyncRAT, a well-known open-source Remote Access Trojan (RAT) frequently used in phishing campaigns. The analysis highlights the malware’s execution flow, persistence mechanisms, defense evasion techniques, and command-and-control infrastructure, providing a complete threat profile.

Analysis Type: Static and Dynamic Malware Analysis Sandbox Used: ANY.RUN Final Verdict: 🚨 Malicious Malware Family: AsyncRAT (f39921e7781804b7862fe7e4fcede70ba52ab5c206adbf0d6e119948f39b61e5.exe)

Static Analysis of AsyncRAT

1. File Identification

The analyzed sample is a Windows Portable Executable file associated with the AsynRAT Trojan family. The following details uniquely identify the file:

• File Name: GoogleUpdate.exe
• Size: 46.59 KB
• Architecture: Win32 PE Intel 80386 (32-bit)
• Entropy: 5.8
• Verdict: MALICIOUS — identified as AsyncRAT
• Framework: .NET (Mono)
• Cryptographic Hashes
• MD5: 37AEDC51004DAF622AB370FB43A2B778
• SHA1: 7865562AFB2E45D412E4051A6AD226798D3CEB6
• SHA256: F39921E7781804B7862FE7E4FCEDE70BA52AB5C206ADBF0D6E119948F39B61E5

2. Masquerading & Metadata Analysis

The malware identifies itself as Google LLC — Google Update, suggesting it’s related to Google’s update mechanism. This implies impersonation of a legitimate software vendor metadata (Google LCC) and an attempt to mimic existing trusted software (GoogleUpdate.exe).

• Timestamp: 2023–10–16 21:40:53 UTC
• PE Type: PE32
• File Version: 1.1.0.2
• Product Name: Google Update
• Company Name: Google LLC

This is a classic masquerading technique designed to reduce user suspicion and evade manual inspection. However, the binary lacks a valid digital signature, confirming it is not genuine Google software.

PE metadata showing spoofed Google branding

Dynamic Analysis — Sandbox Behavioral Intelligence

1. Confirmed Malicious Behaviors

The sandbox execution revealed multiple high-confidence malicious activities:

Registry Persistence

• The malware modifies Windows registry autorun keys, which allows it to execute automatically at system startup or user logon.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Process Masquerading

• Indicates impersonation of trusted filename for evasion. Malicious process running as GoogleUpdate.exe

Network Indicators-

• Domains

bdkb0.ru.com (malicious)

update.bdkb0.ru.com

www.bdkb0.ru.com

fe3cr.delivery.mp.microsoft.com

• IP Addresses

20.190.160.65

154.18.187.209 (MALICIOUS)

20.73.194.208

20.165.94.63

13.95.31.18

49.13.77.253

Contacted URLs

https://login.live.com/RST2.srf

https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping

https://slscr.update.microsoft.com/SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL

https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail

Payloads and Observed Actions

Memory Dump Findings: Source: ANY.RUN Sandbox Analysis Artifacts: 1 memory dumps captured Memory Regions Dumped:

• 0x6b0000 (73728 Bytes) — captured once

Memory analysis shows active in-memory execution of the AsyncRAT. Key findings include:

Indicators of Payload in Memory

Processes linked to impersonation:

• GoogleUpdate.exe (PID: 7960) flagged

Dropped / temporary files created in memory:

The sample drops two files:

• tmpF14C.tmp.bat (Batch script) with SHA256 C971F95CDB5C8894EFA999B6789546E880D0EAA9DA41731C4486348101EEF15B
• GoogleUpdate.exe (Executable) with SHA256 F39921E7781804B7862FE74FCED07E0BA52AB5C206ADBF0D6E119948F39B61E5

2. Behavioral Malware Analysis: AsyncRAT

Legitimate Process Activities Spawned

The malware abused legitimate Windows binaries. These techniques allow the malware to blend into trusted system activity (Living-off-the-Land).

Upon execution of the suspicious sample (f39921e7781804b7862e7e4fcde70ba52ab5c206dabf0d6e119948f39b61e5.exe, the ANY.RUN sandbox recorded a sequence of spawned processes indicative of Remote Access Trojan (RAT) behavior:

cmd.exe (PID: 7544): This acted as the malware loader that initiated execution of a temporary batch script (tmpF14C.tmp.bat) likely used to orchestrate further payload deployment.

conhost.exe (PID: 7552): Served as the console host supporting command-line operations triggered by cmd.exe.

timeout.exe (PID: 7604): Introduces execution delays. A common tactic to evade automated payload analysis stages.

GoogleUpdate.exe (PID: 7856): Masquerades as a legitimate updater and was the primary malicious payload. It was flagged repeatedly by ANY.RUN as a network trojan and positively identified as AsyncRAT.

siul.exe (PID: 8104)

A COM-based process linked to proxy activity and failed HTTP requests, suggesting attempts at outbound communication or C2 relay.

Process timeline showing LOLbins execution

3. Informational & Reconnaissance Events

The malware performed system profiling actions including: Eight informational events were observed. They are common actions performed by legitimate software. Although not malicious on their own, but when they occur simultaneously in a specific sequence, they are strong indicators of malicious intent:

• Reads the machine GUID from the registry
• Checking system language
• Reads the computer name
• Querying proxy settings
• Launching a file from a Registry key
• Checks proxy server information via slui.exe (PID: 7508)
• Creating files in %Temp% and %AppData%

While not malicious individually, the sequence and correlation confirm hostile intent.

4. Process Tree & Execution Flow

Execution Chain: The sandbox execution graph reveals a structured malware activity chain.

1. Initial Suspicious Executable Launched: A randomly-named .exe was executed first. This file served as the primary payload responsible for initiating the attack.
2. Spawning of Windows-like child processes: Instead of exposing itself, the malware spawned multiple Windows-like processes to blend into system activity: cmd.exe, conhost.exe, timeout.exe, slui.exe, svchost.exe. These processes were not legitimate system executions but malware-controlled children used to hide malicious functionality
3. Primary malicious process identified: The most critical process observed was:

GoogleUpdate.exe (PID: 7960): This process was flagged as AsyncRAT and is responsible for the core malicious activities

4. Distributed execution for stealth and evasion: During execution, AsyncRAT demonstrated masquerading which indicate an intent to maintain stealthy, long-term remote access to the infected system.

The process tree clearly illustrates parent-child relationships and malware-controlled execution flow.

ANY.RUN process tree visualization

5. Persistence & Evasion Techniques

Persistence

• Registry Run key modification HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• Execution through disguised GoogleUpdate.exe

Evasion

• Process masquerading
• LOLbins abuse
• Execution delays
• Self-deleting batch scripts
• No valid digital signature

These techniques enable long-term stealthy compromise.

6. Comprehensive Network Activity (Wireshark)

1. Network Behavioural Analysis

The malware sample initiated network communications indicative of Command & Control (C2) infrastructure interaction. The activity followed a three-stage pattern: DNS reconnaissance, C2 resolution, and attempted HTTP-based communication. While connection establishment was successful, the C2 server rejected the malware’s request with an HTTP 400 error, suggesting either protocol mismatch or failed authentication.

2. PCAP File Analysis

1. DNS

The system captured a DNS query (Transaction ID: 0x64ca) for the domain bdkb0.ru.com performed by the malware. This domain serves as the Command and Control (C2) server that utilized a TLD space ru.com occasionally leveraged by threat actors to blend infrastructure geography while maintaining pseudo-legitimacyC2 Communication Behavior

2. C2 Communication Attempt

Following traffic, a TCP session was initiated by the infected host (192.168.100.6:49754) to the IP of the C2 server 154.18.187.209 on http (port 80). Just prior to the connection reset, the server issued a “400 Bad Request”, which indicates that the AsyncRAT malware failed its initial attempt to communicate properly with its C2 server. The server terminated the session immediately after, indicating failed C2 negotiation and no data exfiltration was observed.

Failed communication does not indicate benign behavior but rather failed negotiation or sandbox awareness.

3. Network Activity

Even at static stage, environment telemetry indicates significant network behavior associated with this sample:

• HTTP(S) Requests: 44
• TCP/UDP Connections: 59
• DNS Resolutions: 21
• Network Threat: 7 (All threat identified the malware as a Network Trojan)

4. Command and Control Infrastructure

Domain Contacted:

bdkb0.ru.com (malicious)

update.bdkb0.ru.com

www.bdkb0.ru.com

fe3cr.delivery.mp.microsoft.com

Contacted IP addresses

20.190.160.65

154.18.187.209 (MALICIOUS)

20.73.194.208

20.165.94.63

13.95.31.18

49.13.77.253

Ports- Non-standard ports

• 8808, 5555 — both commonly used by RATs for C2 communication

5. Assessment & Threat Indicators

Suspicious Hosts and Error Handling:

• The domain bdkb0.ru.com is highly suspicious and likely tied to a Dynamic DNS or bulletproof hosting service
• No explicit crash-handling or error reporting processes were spawned, but several HTTP requests returned 404, suggesting failed attempts or sandbox detection

Overall Assessment:

Despite some failed C2 attempts (HTTP 400/404), the malware exhibited persistent beaconing and multiple C2 communication channels. Network activity and AsyncRAT configuration confirm it as a sophisticated Remote Access Trojan capable of sustained remote control and potential data exfiltration.

6. Malware Classification and Impact Analysis

Based on its observed behavior, configuration patterns, and network indicators, this sample is confidently classified as part of the AsyncRAT family (Remote Access Trojan) recognized for its stealth, persistence mechanisms, and extensive control capabilities.

Overall Impact

• Maintains persistence through registry modifications
• Operates discreetly under a process name that appears legitimate
• Communicates with multiple external domains over encrypted channels
• Enables remote access, data exfiltration, and system control
• Presents a significant threat to confidentiality, integrity, and system stability

Immediate response actions are advised, including isolating the compromised system, conducting a thorough forensic investigation, and performing IOC scans across the network.

MITRE ATT&CK MAPPING

The analyzed malware demonstrates behaviors spanning multiple stages of the MITRE ATT&CK framework, indicating a well-structured and deliberate attack lifecycle consistent with a Remote Access Trojan (AsyncRAT).

Execution

The malware initiated its activity using Windows Management Instrumentation (WMI) and scheduled tasks to execute its malicious payload. It relied on the command-line interpreter (cmd.exe), enabling a low-profile execution that helped it evade immediate detection.

After execution, the malware established persistence by modifying autorun registry keys and creating scheduled tasks with delayed triggers — an evasion technique commonly observed in malicious software.

To strengthen its foothold, it escalated privileges by manipulating access tokens and injecting its code into legitimate processes. This allowed the malware to operate within trusted process contexts, further reducing the likelihood of detection.

Discovery and Credential Access

The malware is capable of gathering system and user-related information from the compromised host, including files, system details, and user activity. While this malware family is commonly linked to credential theft, web session cookie extraction, and session hijacking, analysis of this particular variant did not reveal any signs of credential harvesting.

Command and Control

AsyncRAT uses an evasive command-and-control architecture over HTTPS and raw TCP, often leveraging non-standard ports such as 8808 and 5555 to blend with legitimate traffic and evade basic detection. Its C2 infrastructure is resilient, featuring encrypted communications, IP rotation, fallback servers, randomized beaconing, and short-lived sessions to maintain persistent connectivity even in defended network environments.

Defense Evasion

This malware obfuscated its code to conceal its payload, impersonated a trusted software (GoogleUpdate.exe). After execution, the malware removed all traces by deleting itself, evade sandbox analysis and modified registry keys. This gives the malware the ability to evade security tools.

Overall, this comprehensive analysis and MITRE ATT&CK mapping of this malware confirms it as a well-engineered, multi-stage Remote Access Trojan (AsyncRAT). Its coordinated use of execution, persistence, defense evasion, and command-and-control techniques highlights a deliberate design focused on stealth, longevity, and resilience. The sample demonstrates a high level of operational maturity, capable of maintaining persistent remote access while actively avoiding detection.

Key Takeaways

• The malware is a confirmed AsyncRAT Remote Access Trojan, designed for stealthy and persistent system compromise.
• It achieves persistence through registry autorun modifications, allowing it to survive system reboots.
• The sample uses process masquerading (GoogleUpdate.exe) and living-off-the-land binaries to evade detection.
• It performs system reconnaissance by querying registry values to profile the infected host.
• The malware maintains a resilient and encrypted command-and-control infrastructure, including fallback ports and servers, enabling sustained remote access despite failed connection attempts.
• Its capabilities support remote command execution, data exfiltration, and secondary compromise, posing a high risk to system confidentiality, integrity, and availability.
• The presence of this malware constitutes a critical security incident requiring immediate containment and remediation.

Conclusion

The analyzed AsyncRAT sample demonstrates a highly persistent and advanced remote access threat, employing a multi-stage intrusion approach to maintain long-term control over the target system. Its execution is initiated through a command shell, intentionally avoiding user interaction while establishing an initial foothold. Persistence is achieved by embedding itself into system startup processes via registry autorun entries, allowing it to survive system reboots and remain active over time.

A key evasion technique used by the malware is masquerading. It adopts the misleading filename “GoogleUpdate.exe” and imitates legitimate network traffic associated with Microsoft services. This strategy enables it to blend seamlessly with normal system activity, reducing the chances of detection by both users and security solutions. Following execution, the malware performs system discovery by querying registry values to obtain details such as system identifiers, computer names, and language settings. This reconnaissance helps it understand the infected environment and potentially adapt its behavior or prepare for lateral movement.

Its command-and-control (C2) infrastructure is designed for both stealth and resilience. The malware communicates over encrypted channels using standard and non-standard ports, including 8808 and 5555, which are often linked to remote access trojans. Early network observations showed beaconing attempts to the suspicious domain bdkb0.ru.com, with some connections returning HTTP 400 errors — likely due to misconfigurations or protocol inconsistencies. Despite this, the extracted AsyncRAT configuration confirms a fully functional C2 setup with multiple fallback ports, ensuring continued communication and control.

Overall, the observed behavior is consistent with a modular and capable Remote Access Trojan. Its use of evasion techniques, persistence mechanisms, reconnaissance activity, and encrypted C2 communication presents a serious risk to the confidentiality, integrity, and availability of affected systems. Beyond passive data collection, the malware enables remote command execution, data exfiltration, and potential lateral spread within a network. Its presence signifies a critical security breach that requires immediate containment, detailed forensic analysis, and comprehensive remediation to mitigate further impact.

Recommendations

• Implement IOC-based, and behavioral detection (SIEM/EDR) to catch masquerading, registry persistence, and LOLBins abuse and network security controls (DNS filtering, IDS/IPS, port monitoring)
• Conduct proactive threat hunting for suspicious processes, registry changes, abnormal network traffic and maintain incident response readiness
• Use memory forensics and log analysis to detect in-memory payloads and hidden activity
• Strengthen email security and user awareness to prevent phishing-based infections
• Enforce application control and restrict execution from unsafe directories
• Apply least privilege and MFA to reduce unauthorized access
• Ensure secure backups and recovery plans are in place