Kaspersky Details ScreenConnect-to-AsyncRAT Campaign Using Fake Freeware Sites

Jul 1, 2026 · Original article ↗

Summary

Kaspersky MDR traced a campaign using fake freeware sites to sideload ScreenConnect and deploy AsyncRAT. Its investigation describes the multi-stage infection chain, persistence methods, and more than 90 localized domains.

Key points

Kaspersky MDR traced the campaign from spoofed freeware sites offering installers for applications including OBS Studio, DS4Windows, and DNS Jumper.
The installers bundled a signed executable with a malicious DLL that sideloaded ScreenConnect, which attackers used to deploy AsyncRAT.
The infection chain used PowerShell and VBScript to weaken defenses and launch a decrypted payload through process hollowing in RegAsm.exe.
A scheduled task named MasterPackager.Updater ran the script chain every two minutes to maintain persistence.
Kaspersky identified more than 90 campaign domains localized across 10 languages and reported that fraudulent download pages were promoted in search results.
The researchers provide detection guidance for suspicious ScreenConnect child processes, scheduled tasks, and code injection into RegAsm.exe.

Article Details

Attack Vectors: Spoofed freeware websites, promoted in search results, lured users into downloading malicious installer archives.
Archives bundled a legitimate signed install.exe with a rogue install.res.1033.dll; execution used DLL sideloading to install ScreenConnect.
ScreenConnect launched PowerShell and VBScript stages that disabled or weakened defenses, decrypted and reflectively loaded a payload, and created a recurring scheduled task.
The loaded payload used process hollowing to run AsyncRAT inside RegAsm.exe and connect to campaign C2 infrastructure.
Defensive Notes: Restrict software installation with application allowlisting and block MSI execution from untrusted sources.
Monitor for new remote administration services, suspicious ScreenConnect child processes, and scheduled tasks created with schtasks.exe.
Filter outbound traffic to unknown domains and IP addresses, and verify software download sources.
Monitor for suspicious PowerShell or script execution, XOR-based obfuscation, Defender exclusion changes, and code injection into RegAsm.exe.
Use credential monitoring to identify possible account exposure.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`cloudsynn[.]com`	Domain listed as ScreenConnect C2 infrastructure.
DOMAIN	`edgeserv[.]ru`	Domain listed as ScreenConnect C2 infrastructure.
DOMAIN	`ehostservers[.]xyz`	Domain listed as ScreenConnect C2 infrastructure.
DOMAIN	`managedevice[.]xyz`	Domain listed as ScreenConnect C2 infrastructure.
DOMAIN	`manageserver[.]xyz`	Domain listed as ScreenConnect C2 infrastructure.
DOMAIN	`mora1987[.]work[.]gd`	AsyncRAT C2 domain contacted by the hollowed RegAsm.exe process.
DOMAIN	`pingpanl[.]pro`	Domain listed as ScreenConnect C2 infrastructure.
DOMAIN	`pingserv[.]pro`	Domain listed as ScreenConnect C2 infrastructure.
DOMAIN	`r[.]manage-server[.]xyz`	Domain listed as ScreenConnect C2 infrastructure.
DOMAIN	`serverdnsplan[.]net`	Domain listed as ScreenConnect C2 infrastructure.
DOMAIN	`servermanagemen[.]xyz`	ScreenConnect C2 domain; the service command line specified r[.]servermanagemen[.]xyz as its connection server.
DOMAIN	`winservec[.]net`	Domain listed as ScreenConnect C2 infrastructure.
IPV4	`162[.]216[.]241[.]242`	Hosting IP associated with campaign fake software sites, including www[.]studioobs[.]com.
IPV4	`185[.]254[.]97[.]249`	IP listed as ScreenConnect C2 infrastructure.
IPV4	`198[.]23[.]185[.]81`	Campaign infrastructure IP hosting additional resources and download links.
IPV4	`2[.]59[.]134[.]97`	Campaign infrastructure IP hosting fake freeware sites and direct-download.giize[.]com.
IPV4	`45[.]145[.]41[.]205`	IP listed as ScreenConnect C2 infrastructure.
MD5	`0eee9bad07e22415439e854657fa1366`	Hash listed for a malicious loader used in the campaign.
MD5	`5b7e1fe55bd7b5ea54bd4ed1677e5a26`	Hash listed for a malicious loader used in the campaign.
MD5	`5f96c04e3afae97017b201be112284d2`	Hash listed for the malicious install.res.1033.dll library.
MD5	`695e794631ef130583368770e7b81e98`	Hash listed for the malicious install.res.1033.dll library.
MD5	`73bead922109a61e5f9f85771a7812c5`	Hash listed for the malicious install.res.1033.dll library.
MD5	`83601c3d4ed28e8d2be1b99beb8ec18c`	Hash listed for the malicious install.res.1033.dll library.
MD5	`8f4e8b680d3e8d3f5ac39bd72882f713`	Hash listed for a malicious loader used in the campaign.
MD5	`9a9ccd8b0e5d05f4ee77667b024844db`	Hash listed for a malicious loader used in the campaign.
MD5	`b32810973132d11afd61ccee222bbb79`	Hash listed for a malicious loader used in the campaign.
MD5	`edff4f58722c93d7c09ed71899416396`	Hash listed for the malicious install.res.1033.dll library.
URL	`hxxps[:]//direct-download[.]giize[.]com/dns-jumper/iopbsr4hymbo7nfa1q7j`	Malicious archive download URL linked from the spoofed DNS Jumper site.
URL	`hxxps[:]//fileget[.]loseyourip[.]com/obs-studio-windows-full/gVOMs5VZ9BtlcaM`	Malicious archive download URL linked from the spoofed OBS Studio site.
URL	`hxxps[:]//www[.]studioobs[.]com/`	Spoofed OBS Studio download site used to distribute the malicious installer archive.