AsyncRAT

Adversary Tools · AsyncRAT

· ToolS1087 · Dual-use Araç

Type

Tool

Techniques

Used By

2 groups

Platforms

Windows

Description

AsyncRAT is an open-source remote access tool originally available through the NYANxCAT Github repository that has been used in malicious campaigns.(Citation: Morphisec Snip3 May 2021)(Citation: Cisco Operation Layover September 2021)(Citation: Telefonica Snip3 December 2021)

Used By (2 threat groups)

G0099APT-C-36 G1018TA2541

Techniques (20)

T1016System Network Configuration Discovery

discovery

T1033System Owner/User Discovery

discovery

T1053.005Scheduled Task

executionpersistence

T1056.001Keylogging

collectioncredential access

T1057Process Discovery

discovery

T1059.003Windows Command Shell

execution

References

https://attack.mitre.org/software/S1087 https://telefonicatech.com/blog/snip3-investigacion-malware https://blog.morphisec.com/revealing-the-snip3-crypter-a-highly-evasive-rat-loader https://blog.talosintelligence.com/operation-layover-how-we-tracked-attack/