asyncrat: 2b125840 — Google Chrome masquerade, builder-default MessagePack C2 client

Executive Summary Standard AsyncRAT builder-generated client (~100 KB) with per-campaign version-info masquerade claiming "Google Chrome" by "Google LLC". Exhibits the full AsyncRAT capability surface: MessagePack-framed TLS-wrapped TCP C2, AES-256-HMAC encryption, Pastebin dynamic host resolution, registry + scheduled-task persistence, and anti-debug/anti-VM gates. OpenCTI preliminary label dcrat is a false positive — no DCRAT artefacts present. Static-only (no CAPE Windows guest available).

What It Is

• File: EddieTest.exe, 101 888 bytes ^[triage.json]
• PE32 .NET Framework 4.0 Client Profile GUI assembly, 3 sections (.text, .rsrc, .reloc) ^[file.txt] ^[pefile.txt:76-137]
• Linker v8.0, timestamp Mon May 11 07:59:15 2026 UTC ^[pefile.txt:34]
• Version-info masquerade: Company Google LLC, Product Google Chrome, InternalName chrome_exe, FileVersion 148.0.7778.168 ^[exiftool.json] ^[pefile.txt:233-243]
• Import table: single entry mscoree.dll._CorExeMain ^[pefile.txt:255]
• Unsigned, not packed, not obfuscated — raw MSBuild C# output ^[rabin2-info.txt:27]
• Preliminary OpenCTI label dcrat is incorrect; static evidence matches AsyncRAT exclusively (see asyncrat).

How It Works Entry point is Client.Program.Main (radare2 resolves it to entry0 at 0x00402608) ^[r2:entry0]. The binary follows the standard AsyncRAT client architecture observed in siblings abf498a1, a41d0d35, and d3bb6eb4:

• C2 Protocol: TLS-wrapped TCP socket (SslClient / TcpClient / ClientSocket) with MessagePack-framed command dispatch (MessagePackLib.MessagePack) ^[strings.txt:231,434-437,425]. Keepalive heartbeats (KeepAlivePacket, Ping, ActivatePong) maintain the tunnel ^[strings.txt:424,66,216]. Server certificate validation is bypassed or configured via RemoteCertificateValidationCallback ^[strings.txt:150].
• Dynamic C2 Resolution: Pastebin string present — builder option to fetch C2 host from a Pastebin paste at runtime ^[strings.txt:282]. No hardcoded domain/IP in static strings.
• Cryptography: AES-256-CBC with HMAC-SHA256 authentication (Aes256, HMACSHA256 classes) ^[strings.txt:27-29]. Two hardcoded 32-byte hex constants in .text serve as key material / salt: 1DB2A1F9902B35F8F880EF1692CE9947A193D5A698D8F568BDA721658ED4C58B and 87639126EA77B358F26532367DBA67C5310EF50A8D9888ED070CD40E1F605A8F ^[strings.txt:35,41]. Capa confirms AES, MD5, SHA256, and Base64 encode/decode ^[capa.txt:94-99].
• Data Compression: GZip stream compression for C2 traffic / payload staging (GZipStream, Compress, Decompress) ^[strings.txt:262,400,401] ^[capa.txt:91-93].
• Persistence: Dual-path — registry Run key (SetRegistry, RegistryValueKind, CreateSubKey) ^[strings.txt:487,78,473] and scheduled task creation (schtasks referenced, 4 capa matches) ^[capa.txt:132]. Also hooks SystemEvents.SessionEnding for cleanup on logoff ^[strings.txt:196-197].
• Anti-Analysis: DetectDebugger, DetectSandboxie, DetectManufacturer — checks for debuggers, sandbox artefacts, and VM hostnames ^[strings.txt:331,92,336] ^[capa.txt:79-86]. RtlSetProcessIsCritical and ProcessCritical for self-defense ^[strings.txt:241-242]. SetThreadExecutionState with ES_SYSTEM_REQUIRED | ES_DISPLAY_REQUIRED | ES_CONTINUOUS to prevent sleep ^[strings.txt:36-38,44].
• System Discovery: Hostname, OS version, processor count, disk size, username, integrity level, installed AV (via WMI ManagementObjectSearcher), active window title (GetForegroundWindow / GetWindowText), and file/directory enumeration ^[strings.txt:124-129,285,332,460-461] ^[capa.txt:100-126].
• Process Manipulation: Create process (with redirected I/O and hidden window), terminate process, enumerate processes, create/suspend thread ^[capa.txt:113-128].
• Mutex Gating: CreateMutex / CloseMutex for single-instance enforcement ^[strings.txt:463-464] ^[capa.txt:109].
• Session Ending Handler: ClientOnExit wired to SystemEvents.SessionEnding for graceful teardown ^[strings.txt:429,196-197].

Decompiled Behavior Ghidra analysis completed on the CIL backend. Symbol table reveals the expected AsyncRAT surface: DetectDebugger at 0x004035e8, DetectSandboxie at 0x0040362c, DetectManufacturer at 0x004034ac, ClientOnExit at 0x00403924, Encrypt at 0x00404178, Decrypt at 0x004042d0, Compress at 0x00405978, Decompress at 0x004058ec, Antivirus at 0x0040399c ^[ghidra: various addresses]. No unexpected native API imports beyond standard .NET P/Invoke to kernel32.dll, user32.dll, ntdll.dll ^[strings.txt:250-252]. Full IL-level decompilation would require dnSpy/ILSpy; Ghidra's CIL pseudo-C is structurally accurate but abstracts stack-machine operations.

C2 Infrastructure No hardcoded IP, domain, or port. Pastebin string indicates runtime resolution from a paste URL configured at build time ^[strings.txt:282]. C2 protocol: raw TCP → TLS upgrade → MessagePack-framed AES-256-HMAC payload. Sub-server or proxy chaining not observed in this sample (no subNode / subServer strings as seen in XenoRAT).

Interesting Tidbits

• EddieTest.exe filename suggests a builder test run or sandbox detonation filename, not the original distribution name.
• The Google Chrome masquerade is unusually polished — complete with LegalCopyright, LegalTrademarks, and a 256×256 PNG icon in .rsrc ^[binwalk.txt:6]. This is the most elaborate version-info forgery observed in the AsyncRAT cluster to date.
• .rsrc section entropy is 7.33 due to the large embedded icon; this is benign artefact, not encrypted payload ^[pefile.txt:112].
• floss.txt failed to execute due to a CLI argument parsing error (--no flag misparsed); no decoded string layer is available ^[floss.txt].
• No plugin system strings (Plugin, savePlugin, sendPlugin) — this is a stripped build compared to sibling d3bb6eb4.
• No keylogger module (LowLevelKeyboardProc, SetWindowsHookEx absent) — consistent with the stripped-builder-default configuration.

How To Mess With It (Homelab Replication)

• Toolchain: Visual Studio 2022, .NET Framework 4.0 Client Profile target
• Build a C# WinForms/Console app with System.Net.Sockets.TcpClient, System.Net.Security.SslStream, System.IO.Compression.GZipStream, and System.Security.Cryptography.AesManaged + HMACSHA256
• Add MessagePack serialization via MessagePackLib or MsgPack-Cli
• Implement RemoteCertificateValidationCallback to accept any server cert
• Wire SystemEvents.SessionEnding for cleanup
• Run capa <reproducer.exe> and compare to this sample's capa.txt — expect hits on communication/socket/tcp, data-manipulation/compression, data-manipulation/encoding/base64, data-manipulation/encryption/aes, host-interaction/registry/create, persistence/scheduled-tasks

Deployable Signatures

YARA rule

rule AsyncRAT_ChromeMasquerade_2b125840 {
    meta:
        description = "AsyncRAT builder client with Google Chrome version-info masquerade"
        author = "PacketPursuit SOC"
        date = "2026-06-15"
        sha256 = "2b125840b1f69be0cd1652e051dca93eb9ee54a3c86494054fd061bca877492f"
    strings:
        $a1 = "MessagePackLib.MessagePack" ascii wide
        $a2 = "Client.Install" ascii wide
        $a3 = "Client.Connection" ascii wide
        $a4 = "Client.Helper" ascii wide
        $a5 = "Client.Handle_Packet" ascii wide
        $b1 = "Aes256" ascii wide
        $b2 = "HMACSHA256" ascii wide
        $b3 = "SslClient" ascii wide
        $b4 = "TcpClient" ascii wide
        $b5 = "Pastebin" ascii wide
        $b6 = "KeepAlivePacket" ascii wide
        $b7 = "ActivatePong" ascii wide
        $c1 = "Google Chrome" ascii wide
        $c2 = "Google LLC" ascii wide
        $c3 = "chrome_exe" ascii wide
        $d1 = "RtlSetProcessIsCritical" ascii wide
        $d2 = "DetectSandboxie" ascii wide
        $d3 = "SetThreadExecutionState" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        filesize < 150KB and
        (2 of ($a*)) and
        (4 of ($b*)) and
        (2 of ($c*)) and
        (2 of ($d*))
}

Behavioral hunt query (KQL / Microsoft Defender for Endpoint)

DeviceProcessEvents
| where FileName contains "EddieTest.exe" or FileName contains "chrome_exe"
| union (
    DeviceRegistryEvents
    | where InitiatingProcessFileName contains "EddieTest.exe"
    | where RegistryKey contains "\\Software\\Microsoft\\Windows\\CurrentVersion\\Run"
)
| union (
    DeviceNetworkEvents
    | where InitiatingProcessFileName contains "EddieTest.exe"
    | where RemotePort in (80, 443, 8080)
)

IOC list

• SHA-256: 2b125840b1f69be0cd1652e051dca93eb9ee54a3c86494054fd061bca877492f
• SHA-1: fa68217a02ceae00ed8e27bf540b5c21422ca018
• MD5: 5a0a4b6e16b83284358672c9a31a2861
• ssdeep: 3072:iuMuT0sn2HBMr3bkiFCdetnRPF9EVnb43jaI5grK+:iuMu2g3ba8tnRPF9cCGrT
• Version-info masquerade: Google Chrome, Google LLC, chrome_exe, 148.0.7778.168
• Mutex: single-instance via CreateMutex (name runtime-derived, not static)
• Registry persistence: HKCU\Software\Microsoft\Windows\CurrentVersion\Run via SetRegistry
• Scheduled task: schtasks /create (4 capa matches)

Detection Signatures

• capa maps to ATT&CK: T1560.002, T1140, T1070.004, T1112, T1027, T1620, T1497.001, T1087, T1083, T1057, T1012, T1518, T1082, T1033, T1047, T1053.005 ^[capa.txt:12-33]
• capa MBC: B0001.002, B0001.031, B0007, B0009, B0030.002, C0011.001, C0002.017, C0001.011, C0029.001, C0029.003, C0021.003, C0024, C0053.001, C0026.001, E1027.m02, F0007.001, E1010, E1083, E1082, C0047, C0051, C0036.002, C0036.007, C0036.005, C0036.006, C0036.001, C0042, C0017, C0038, C0055, C0018 ^[capa.txt:35-75]

References

• asyncrat — entity page for the AsyncRAT family
• messagepack-asynchronous-rat-protocol — MessagePack framing pattern
• registry-run-persistence — T1547.001 procedure observed here
• OpenCTI artifact ID: 0507cedb-def3-4a0f-9a65-b717937d2073
• MalwareBazaar source (implied by triage labels)

Provenance Analysis derived from static artefacts: file(1), exiftool, pefile, strings, capa v7, binwalk, radare2 (aa level 3), and Ghidra CIL backend. No dynamic execution data available (CAPE skipped — no Windows guest). FLOSS execution failed due to CLI argument misparsing. Report authored 2026-06-15.