asyncrat: e57d8c5a — VIN88APP.exe, builder-default stripped build (~28 KB)

Executive Summary

Builder-default AsyncRAT client compiled as a .NET Framework 4.8 PE32. No obfuscation, no packing, no plugins beyond the core RAT stack. Masquerade identity VIN88APP.exe follows the same XU88APP.exe naming pattern observed in sibling d3bb6eb4 (AU88APP.exe). Static-only analysis; CAPE skipped due to no Windows guest.

What It Is

Attribution evidence: every namespace string, class name, and capability matches the AsyncRAT builder default. MessagePackLib, Client.Install, Client.Algorithm, Client.Connection, Client.Handle_Packet, SslClient, TcpClient, KeepAlivePacket, Aes256, HMACSHA256, Pastebin, DetectDebugger, DetectSandboxie, MutexControl, SetThreadExecutionState, PreventSleep — the full AsyncRAT vocabulary is present unchanged. ^[strings.txt:31-410] The XU88APP.exe filename pattern is shared with sibling d3bb6eb4 (AU88APP.exe), suggesting a common operator or builder campaign.

How It Works

Entry / Installation

Client.Install handles persistence and staging. Expected behaviour (inferred from strings + capa, consistent with AsyncRAT cluster):

• Copies itself to %APPDATA% or %TEMP% under a random or fixed name ^[capa.txt:97]
• Writes a Registry Run key (SetRegistry, RegistryValueKind) ^[strings.txt:64,394] ^[capa.txt:116-118]
• Creates a scheduled task via schtasks (4 capa matches) ^[capa.txt:128-129]
• Creates a mutex (MutexControl, CreateMutex, CloseMutex) for single-instance gating ^[strings.txt:212,381-382] ^[capa.txt:105]

C2 Communication

• TLS-wrapped TCP socket (SslClient, TcpClient, AuthenticateAsClient) ^[strings.txt:215,356-358] ^[capa.txt:85-88]
• MessagePack-framed command dispatch (MessagePackLib.MessagePack, unpack_msgpack) ^[strings.txt:191-196] ^[capa.txt]
• Keepalive / ping-pong (KeepAlivePacket, Ping, ActivatePong) ^[strings.txt:56-57,159-160,178-179]
• Server certificate validation via RemoteCertificateValidationCallback ^[strings.txt:194] ^[capa.txt:122]
• Dynamic C2 host resolution via Pastebin string present ^[strings.txt:232] — builder option to fetch C2 from a Pastebin raw URL

Cryptography

• AES-256-CBC with HMAC-SHA256 authentication (Aes256, HMACSHA256, ComputeHash) ^[strings.txt:16-18,181-183] ^[capa.txt:91-93]
• Base64 encode/decode for data transport ^[strings.txt:168-169] ^[capa.txt:89-91]
• One hardcoded 32-byte hex string observed: 1DB2A1F9902B35F8F880EF1692CE9947A193D5A698D8F568BDA721658ED4C58B — likely key material or salt ^[strings.txt:23]

Anti-Analysis

• Debugger detection: CheckRemoteDebuggerPresent, IsDebuggerPresent, WudfIsAnyDebuggerPresent ^[strings.txt:364-365] ^[capa.txt:76-78]
• Sandbox detection: DetectSandboxie, DetectManufacturer, IsSmallDisk ^[strings.txt:76,198,278] ^[capa.txt:79-83]
• VM string references targeting VMware and VirtualBox ^[capa.txt:79-83]
• Process hardening: RtlSetProcessIsCritical / ProcessCritical ^[strings.txt:200-201] ^[capa.txt]
• Sleep prevention: SetThreadExecutionState (ES_SYSTEM_REQUIRED, ES_DISPLAY_REQUIRED, ES_CONTINUOUS) ^[strings.txt:24-26,32] ^[capa.txt:125]

System Discovery

Extensive host reconnaissance via WMI and .NET Framework APIs:

• Hostname, username, OS version, machine name ^[strings.txt:100-104] ^[capa.txt:106-108]
• Processor count, disk size ^[strings.txt:103-104] ^[capa.txt:103-104]
• Integrity level (get_SessionIntegrityLevel) ^[capa.txt:121]
• Installed AV enumeration (Antivirus) ^[strings.txt:334] ^[capa.txt]
• Active window title (GetActiveWindowTitle, GetForegroundWindow, GetWindowText) ^[strings.txt:89,378-379] ^[capa.txt:102]
• File/directory enumeration, process enumeration ^[capa.txt:98-99,112-113]

Decompiled Behavior

Native decompilation not attempted — this is a .NET CIL assembly best analyzed with dnSpy/ILSpy, which are not available in this toolchain. Static analysis via strings and capa provides sufficient behavioural coverage for an unobfuscated builder-default build. All control flow is standard .NET async/await with System.Threading.Thread callbacks.

C2 Infrastructure

No hardcoded IP/domain recovered statically. The Pastebin string ^[strings.txt:232] indicates C2 host is likely resolved at runtime via a Pastebin raw URL (builder default). No observable network IOCs in strings — the C2 endpoint is runtime-configured.

Interesting Tidbits

• PDB path reuse: C:\new\Client\obj\Debug\VIN88APP.pdb mirrors the C:\new\Client\obj\Debug path seen in other AsyncRAT siblings, confirming a shared builder environment or operator habit. ^[pefile.txt:353]
• Version-info forgery: Assembly version 1.0.0.0 with empty CompanyName, ProductName, and LegalCopyright — minimal effort masquerade. ^[exiftool.json:36-45]
• No plugin modules: Unlike sibling 045c7c54 which carries a keylogger (LowLevelKeyboardProc), this build lacks SetWindowsHookEx or keyboard-hook strings. Stripped/core-only configuration.
• No GZip compression: Sibling abf498a1 shows GZip capa matches; this build does not, suggesting a builder option toggle.
• Fabricated timestamp: 2095 compilation date is impossible; the linker did not stamp a real build time. ^[pefile.txt:34]

How To Mess With It (Homelab Replication)

1. Download the AsyncRAT-C-Sharp builder (NYAN-x-CAT/AsyncRAT-C-Sharp, v0.5.7b or similar).
2. Build a client with:
   • Target: .NET Framework 4.8
   • C2 host: your lab listener IP
   • Pastebin URL: optional (leave blank for hardcoded host)
   • Enable/Disable keylogger, GZip, and plugin modules to observe capa deltas.
3. Compile in Debug configuration — observe the obj\Debug\<name>.pdb path in the PE debug directory.
4. Run capa <output.exe> and compare to this sample's capa.txt. A builder-default build should hit the same capability set (anti-debug, anti-VM, registry persistence, scheduled task, MessagePack, AES, Base64, TCP socket, WMI discovery).
5. What you'll learn: how a commodity open-source RAT builder fingerprints in capa and how each optional module changes the static surface.

Deployable Signatures

YARA Rule

rule AsyncRAT_VIN88APP_Sibling
{
    meta:
        description = "AsyncRAT builder-default client — VIN88APP/AU88APP naming pattern"
        author = "pp-hermes"
        date = "2026-06-15"
        sha256 = "e57d8c5a773d523e7e9d3f5d8fc5aa57689a4abe47bfed2805d0fe05019ff2dd"
        family = "asyncrat"
    strings:
        $a1 = "MessagePackLib" ascii wide
        $a2 = "Client.Install" ascii wide
        $a3 = "Client.Connection" ascii wide
        $a4 = "Client.Algorithm" ascii wide
        $a5 = "Client.Handle_Packet" ascii wide
        $a6 = "SslClient" ascii wide
        $a7 = "TcpClient" ascii wide
        $a8 = "KeepAlivePacket" ascii wide
        $a9 = "ActivatePong" ascii wide
        $a10 = "DetectDebugger" ascii wide
        $a11 = "DetectSandboxie" ascii wide
        $a12 = "MutexControl" ascii wide
        $a13 = "Pastebin" ascii wide
        $a14 = "SetThreadExecutionState" ascii wide
        $a15 = "PreventSleep" ascii wide
        $a16 = "HwidGen" ascii wide
        $b1 = "Aes256" ascii wide
        $b2 = "HMACSHA256" ascii wide
        $c1 = /[A-Z]{2,3}88APP\.exe/ ascii wide
    condition:
        uint16(0) == 0x5A4D and
        (4 of ($a*) or (3 of ($a*) and 1 of ($b*))) and
        filesize < 50KB
}

Sigma Rule

title: AsyncRAT Builder-Default Process Spawn Indicators
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        CommandLine|contains:
            - 'schtasks /create'
            - 'REG ADD HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run'
        ParentImage|endswith:
            - 'VIN88APP.exe'
            - 'AU88APP.exe'
    condition: selection
falsepositives:
    - Unknown
level: high

IOC List

Behavioral Fingerprint Statement

This binary is a .NET Framework 4.8 PE32 with a minimal 3-section layout, only mscoree.dll in the import table, and no packing. Upon execution it enumerates the host via WMI and .NET APIs (hostname, OS version, processor count, disk size, installed AV, active window), performs debugger and sandbox checks (CheckRemoteDebuggerPresent, IsDebuggerPresent, VMware/VirtualBox string checks), then establishes a TLS-wrapped TCP connection to a C2 server. Traffic is framed with MessagePack and encrypted with AES-256-CBC plus HMAC-SHA256. Persistence is achieved via Registry Run keys and scheduled tasks. The binary prevents system sleep via SetThreadExecutionState. No keylogger module is present in this stripped build.

Detection Signatures (capa → ATT&CK)

References

• Artifact ID: c387fdce-5bd6-441e-b7ab-6483f1be4327
• Source: OpenCTI / MalwareBazaar
• Family page: asyncrat
• Wire-format technique: messagepack-asynchronous-rat-protocol
• Persistence procedure: registry-run-persistence
• Sibling analyses: abf498a1, 045c7c54, a41d0d35, d3bb6eb4, 2b125840

Provenance

Analysis derived from:

• file.txt (file-type identification)
• pefile.txt (PE headers, sections, imports, resources, debug directory)
• strings.txt (static strings, namespace/class layout)
• capa.txt (capability detection via Mandiant flare-capa v7.x)
• exiftool.json (version information, metadata)
• rabin2-info.txt (radare2 binary header summary)
• triage.json (triage pipeline metadata)
• No CAPE detonation available (no Windows guest). Dynamic behaviour inferred from static indicators consistent with the AsyncRAT cluster.