30
Search: “Obfuscated PowerShell script”
209 stories
30
AsyncRAT Malware Abuses AutoIt and PowerShell to Hide Inside Legitimate Windows Process
Point Wild details a five-stage AsyncRAT campaign using AutoIt abuse and process injection to hide a .NET RAT inside Microsoft's signed charmap.exe.
Researchers at Point Wild Threat Intelligence analyzed a campaign starting from a lure batch file ('Right-click to open Invoice Details.bat') that launches hidden PowerShell to reconstruct a Base64/XOR-obfuscated payload. The stage drops a renamed signed AutoIt interpreter and loader script into %LOCALAPPDATA%\Temp and achieves persistence via a batch file in the user's Startup folder (T1547.001). The loader decrypts the payload in memory with single-byte XOR key 0x36 and injects it into SysWOW64\charmap.exe using OpenProcess/VirtualAllocEx/WriteProcessMemory/CreateRemoteThread, with PE-sieve confirming an in-memory implanted PE and patched AMSI modules. The final AsyncRAT payload performs screen capture and data theft, with observed C2 at 158[.]51[.]122[.]136:4944 over raw TCP.
48
30
30
30
45
30
35
30
45
30
30
30
30
30
30
30
30
30
30
45
30
30
30
45
30
30
30
30
30
30
45
45
30
45
30
30
35
WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords
Gen Digital details WordlistLoader delivering Amatera Stealer via ClickFix and EtherHiding, while SynkLoader phishes Windows credentials through Microsoft Teams.
Gen Digital identified WordlistLoader, an intermediate stage that reconstructs shellcode encoded as plain English words (or 16-byte UUID chunks) and loads Amatera Stealer 4.3.3-alpha1, delivered through ClearFake ClickFix prompts on compromised websites. The chain uses EtherHiding to fetch JavaScript from a blockchain smart contract, hidden cmd.exe via conhost, WebDAV-mounted shares with rundll32 execution, and ETW bypass via hardware breakpoints. The stealer adds hardened WoW64 syscalls, Heaven's Gate indirect-syscall trampolines and a redesigned application-bound encryption bypass. Separately, Expel observed SynkLoader distributed via Microsoft Teams phishing impersonating IT service desks, installing an MSI from Azure blob storage and serving a fake lock screen to capture credentials.
55