AsyncRAT: a41d0d35 — System Informer masquerade, stripped build

Executive Summary

Confirmed AsyncRAT sibling (zui.exe, ~46 KB) compiled May 2020. Masquerades as "System Informer - Setup" via fabricated VS_VERSIONINFO. Stripped build: lacks keylogger module and plugin system observed in other siblings. C2 host is runtime-resolved (Pastebin string present; no hardcoded domain in static strings). Static-only — CAPE skipped due to no Windows guest. See asyncrat entity page for cluster-wide analysis.

1. Build / RE

Toolchain & Framework

• Language: C# / .NET Framework 4.0 Client Profile (CLR v4.0.30319). ^[file.txt], ^[rabin2-info.txt]
• Format: PE32, GUI subsystem, 3 sections (.text, .rsrc, .reloc). ^[pefile.txt:76-137]
• Linker: Microsoft linker v8.0 (PE optional header MajorLinkerVersion=8). ^[pefile.txt:45-46]
• Compilation timestamp: Sun May 10 05:24:51 2020 UTC (TimeDateStamp 0x5EB79023). ^[pefile.txt:34], ^[exiftool.json:15]
• Import table: Minimal — only mscoree.dll._CorExeMain. ^[pefile.txt:255]
• Signing: Unsigned. ^[rabin2-info.txt:27], ^[pefile.txt:153-154]

Packing / Obfuscation

• None. Unobfuscated .NET assembly — no ConfuserEx, no SmartAssembly, no name mangling. Readable class/namespace/method names intact in .text metadata. ^[strings.txt], ^[capa.txt:134]
• Binwalk detects LZMA compressed data at offset 0xB401 with dictionary size: 786432 bytes, uncompressed size: 926941184 bytes. ^[binwalk.txt:6] This is consistent with .NET runtime metadata or compressed resource streams rather than a deliberate packer; the assembly is fully analyzable without unpacking.

Anti-Analysis

• Debugger detection: CheckRemoteDebuggerPresent, IsDebuggerPresent, DetectDebugger method. ^[capa.txt:80], ^[strings.txt:331,445,446]
• Sandbox / VM detection: DetectSandboxie, DetectManufacturer, IsSmallDisk, IsXP. References anti-VM strings targeting VMware and VirtualBox per capa. ^[capa.txt:82-85], ^[strings.txt:92,336,239]
• Self-defense: RtlSetProcessIsCritical / ProcessCritical.Set — marks process as critical so termination triggers BSOD. ^[strings.txt:241,242], ^[capa.txt:117]
• Prevention of sleep: SetThreadExecutionState with ES_SYSTEM_REQUIRED | ES_DISPLAY_REQUIRED | ES_CONTINUOUS. ^[strings.txt:36-38,44], ^[capa.txt:153]
• Mutex: MutexControl.CreateMutex / CloseMutex for single-instance gating. ^[strings.txt:255,463], ^[capa.txt:120]

Notable Functions (radare2)

• method.Client.Helper.Anti_Analysis.RunAntiAnalysis — orchestrates environment checks. ^[r2:function list]
• method.Client.Helper.Anti_Analysis.DetectManufacturer — hardware fingerprinting. ^[r2:function list]
• method.Client.Helper.ProcessCritical.Set / .Exit — RtlSetProcessIsCritical wrapper. ^[r2:function list]
• method.Client.Connection.ClientSocket.InitializeClient — TLS + TCP bootstrap. ^[r2:function list]
• method.Client.Connection.ClientSocket.ReadServertData — C2 receive loop. ^[r2:function list]
• method.Client.Install.NormalStartup.Install — persistence installer. ^[r2:function list]
• method.Client.Helper.HwidGen.HWID — host fingerprinting for C2 enrollment. ^[r2:function list]
• method.Client.Algorithm.Aes256.Encrypt / .Decrypt — AES-256-CBC with HMAC-SHA256 auth. ^[r2:function list]

Masquerade & OPSEC

• Version-info resource claims: CompanyName: System Informer, FileDescription: System Informer - Setup, InternalName: systeminformer-setup.exe, OriginalFilename: systeminformer-setup.exe, ProductName: System Informer. ^[pefile.txt:233-243], ^[exiftool.json:37-43]
• This is a deliberate forgery of the legitimate Process Hacker successor (formerly Process Hacker, now System Informer by Winsider Seminars & Solutions, Inc.). The version string 3.2.25011.2103 does not match any known legitimate release and appears fabricated. ^[exiftool.json:27-28]

Stripped Module Delta

Compared to siblings 045c7c54 (keylogger module) and d3bb6eb4 (plugin system), this sample is stripped:

• Absent: LowLevelKeyboardProc, SetWindowsHookEx, offlineKL — no keylogger. ^[strings.txt] (not present)
• Absent: Plugin.Plugin, savePlugin, sendPlugin — no plugin architecture. ^[strings.txt] (not present)
• Present: Core RAT functionality (C2, crypto, discovery, persistence, anti-analysis) is intact. This is consistent with the open-source AsyncRAT builder where modules are optional checkboxes.

2. Deploy / ATT&CK

Persistence

• T1547.001 — Registry Run Keys: SetRegistry.SetValue writes to HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run. ^[capa.txt:121-123], ^[strings.txt:486,476-478]
• T1053.005 — Scheduled Task: schtasks referenced 4 times in capa. ^[capa.txt:131-132]

Defense Evasion

• T1497.001 — Virtualization/Sandbox Evasion: System checks (VMware/VBox strings, IsSmallDisk, DetectManufacturer, IsXP). ^[capa.txt:22-23]
• B0001.002 / B0001.031 — Debugger Detection: CheckRemoteDebuggerPresent, WudfIsAnyDebuggerPresent. ^[capa.txt:37-40]
• T1620 — Reflective Code Loading: .NET assembly loads and executes entirely in-memory via CLR; no native unpack stub. ^[capa.txt:21]
• T1140 — Deobfuscate/Decode Files or Information: Base64 + GZip decoding of C2 payloads. ^[capa.txt:17]
• T1070.004 — Indicator Removal: File Deletion (self-delete via COMSPEC env var per capa, plus DeleteFile). ^[capa.txt:18,58-59]
• T1027 — Obfuscated Files or Information: Standard algorithm encoding (Base64 + GZip) applied to C2 traffic. ^[capa.txt:20,55-57]

Discovery

• T1087 — Account Discovery
• T1083 — File and Directory Discovery
• T1057 — Process Discovery
• T1012 — Query Registry
• T1518 — Software Discovery (installed AV via WMI)
• T1082 — System Information Discovery (hostname, OS version, processor count, disk size)
• T1033 — System Owner/User Discovery (username, integrity level) All above from capa DISCOVERY tactic block. ^[capa.txt:24-30]

Collection

• T1560.002 — Archive Collected Data: GZip compression of outbound data. ^[capa.txt:15-16]

Execution

• T1047 — Windows Management Instrumentation: ManagementObjectSearcher, ManagementObjectCollection used for system discovery and AV enumeration. ^[capa.txt:31], ^[strings.txt:332,291,333]

C2 Protocol

• T1571 — Non-Standard Application Layer Protocol: TLS-wrapped TCP socket (SslClient / TcpClient / SslStream), not HTTP. ^[strings.txt:258,259,435,436]
• T1573.001 — Encrypted Channel: AES-256-CBC with HMAC-SHA256 authentication over the TLS tunnel. ^[capa.txt:15-16,48-51], ^[strings.txt:27-29,57-58]
• T1105 — Ingress Tool Transfer: WebClient.DownloadString and NetworkStream read/write for payload delivery. ^[strings.txt:204,258]
• Dynamic host resolution: Pastebin string present in .text. ^[strings.txt:283] Builder supports fetching C2 host from a Pastebin raw URL at runtime; no hardcoded IP or domain is visible statically. This is a common AsyncRAT builder option.
• Framing: MessagePack-serialized command objects (MessagePackLib.MessagePack, MsgPack, unpack_msgpack). ^[strings.txt:34,230,231,236]
• Keepalive: KeepAlivePacket, Ping, ActivatePong, Interval — heartbeat every N seconds. ^[strings.txt:66,69,67,70,216,217,192,193]
• Server certificate validation: RemoteCertificateValidationCallback, ValidateServerCertificate. ^[strings.txt:234,151]

Credential Access

• NetworkCredential class and ICredentials interface referenced; capa notes "manipulate network credentials in .NET". ^[capa.txt:87-88], ^[strings.txt:243,381]

Impact / Self-Defense

• RtlSetProcessIsCritical makes process critical; terminating it causes system bugcheck (BSOD). ^[strings.txt:241], ^[capa.txt:117]
• SetThreadExecutionState prevents screen lock / sleep. ^[capa.txt:153]

C2 Infrastructure

• No static IOCs. C2 host is runtime-resolved via Pastebin (builder option). No hardcoded IP, domain, or URL found in strings.
• Mutex name: Not recovered statically; generated at runtime via HwidGen.HWID likely combined with a salt.

Interesting Tidbits

• Floss analysis failed due to bad CLI invocation (--no flag collision); no decoded strings recovered. ^[floss.txt]
• Binwalk LZMA hit at 0xB401 with implausibly large uncompressed size (926 MB) — almost certainly false positive from .NET metadata stream alignment, not a real payload.
• The 1.0.0.0 assembly version in metadata is distinct from the 3.2.25011.2103 version-info string — the latter is the fabricated masquerade, the former is the builder default.
• This sample's 46 KB size is mid-range for AsyncRAT (siblings range 27 KB d3bb6eb4 to ~100 KB); size correlates with stripped vs full module selection in the builder.

Deployable Signatures

YARA

rule AsyncRAT_SystemInformer_Masquerade {
    meta:
        description = "AsyncRAT with System Informer version-info masquerade"
        author = "PacketPursuit SOC"
        date = "2026-06-12"
        sha256 = "a41d0d358d23125da8894e23b25463152f0ae6b6ea545f6f84e8cd5c679afb15"
    strings:
        $a1 = "System Informer" ascii wide
        $a2 = "systeminformer-setup.exe" ascii wide
        $a3 = "Winsider Seminars & Solutions, Inc." ascii wide
        $b1 = "Client.Connection.ClientSocket" ascii
        $b2 = "MessagePackLib.MessagePack" ascii
        $b3 = "Client.Helper.Anti_Analysis" ascii
        $b4 = "Client.Algorithm.Aes256" ascii
        $b5 = "Pastebin" ascii
    condition:
        uint16(0) == 0x5A4D and
        (2 of ($a*)) and (3 of ($b*))
}

Behavioral Fingerprint

A .NET PE32 with only mscoree.dll._CorExeMain in imports, three sections, and CLR v4.0.30319 metadata. At runtime it resolves a C2 host (possibly via Pastebin), establishes a TLS-wrapped TCP connection, and exchanges MessagePack-framed AES-256-HMAC encrypted commands. It performs sandbox checks (disk size, manufacturer, XP detection, debugger checks), sets itself as a critical process, and establishes persistence via registry Run keys and scheduled tasks. No keylogger hooks or plugin loading observed in this stripped variant.

IOC List

Detection Signatures (capa → ATT&CK)

See capa.txt for full mapping. Key tactics: COLLECTION (T1560.002), DEFENSE EVASION (T1140, T1070.004, T1112, T1027, T1620, T1497.001), DISCOVERY (T1087, T1083, T1057, T1012, T1518, T1082, T1033), EXECUTION (T1047), PERSISTENCE (T1053.005). ^[capa.txt:15-33]

References

• asyncrat — Cluster entity page with full build-stack and TTP summary.
• messagepack-asynchronous-rat-protocol — Wire-format deep-dive.
• version-info-masquerade — Generic technique page for forged PE version info.
• AsyncRAT open-source builder: NYAN-x-CAT/AsyncRAT-C-Sharp (GitHub, since removed).

Provenance

• file.txt, pefile.txt, strings.txt, capa.txt, floss.txt, binwalk.txt, rabin2-info.txt, exiftool.json, metadata.json, triage.json — all from wiki/wiki/raw/analyses/a41d0d358d23125da8894e23b25463152f0ae6b6ea545f6f84e8cd5c679afb15/
• radare2 analysis performed live on a41d0d358d23125da8894e23b25463152f0ae6b6ea545f6f84e8cd5c679afb15.bin (345 functions, 3 sections).
• pyghidra import queued; string/code indexing not complete at time of report (background analysis ongoing).
• CAPE detonation skipped — no Windows guest available. All behaviour inferred from static analysis.