AsyncRAT C2 Framework: Overview, Technical Analysis & Detection | Qualys
Summary: Qualys published a technical analysis of the AsyncRAT command-and-control framework, a remote access trojan offering keylogging, audio/video recording, info-stealing, remote desktop control, password recovery, remote shell, webcam access and payload injection over an encrypted connection. The writeup attributes AsyncRAT to the Operation Layover aviation campaign run by TA2541 using aviation-themed Word documents, a social engineering campaign targeting Thailand pass customers, and the Follina outbreak in Australia, and describes its anti-analysis checks for debuggers, VMs, sandboxes and small disks plus persistence via scheduled tasks or a Run registry key.
Key Takeaway: AsyncRAT ships with built-in checks for debuggers, VMware, VirtualBox, SbieDll.dll sandboxes and small disks, so an analysis environment that looks like a lab will not see it - and its default mutex value of "AsyncMutex_6SI8OkPnk" is a concrete detection handle most teams are not using.
Read the original at Qualys Blog ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026