Using CyberChef to Decode an Obfuscated AsyncRAT Loader
Summary
Huntress analysts show how they used CyberChef and regex to decode an obfuscated VBS script found persisting via a scheduled task, revealing a chain that led to an AsyncRAT loader.
Key points
- Huntress began investigating after persistence monitoring flagged a suspicious VBS script in a user’s startup directory, persisting through a scheduled task.
- The analysts used CyberChef syntax highlighting and regex-based subsections to isolate and decode decimal values wrapped in Visual Basic Chr functions.
- They decoded reversed strings using regex and CyberChef’s Reverse operation, and handled Replace obfuscation with regex capture groups and registers.
- The final string concatenations were resolved by substituting JavaScript’s plus operator and using a developer console.
- The decoded script used PowerShell to execute a batch payload; that batch script led to another obfuscated PowerShell script containing an AsyncRAT loader.
Article Details
- Topic
- Analysis and decoding of an obfuscated VBScript loader that launches an AsyncRat payload
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe VBScript, batch script, and PowerShell script were obfuscated; the VBScript used decimal encoding, reversed strings, replacement operations, and string concatenation.T1053.005 · Scheduled TaskA suspicious VBScript persisted through a scheduled task.T1059.001 · PowerShellThe batch script unraveled into an obfuscated PowerShell script containing an AsyncRat loader.T1059.003 · Windows Command ShellThe VBScript launched a second payload stored as a batch script.T1059.005 · Visual BasicThe initial loader was an obfuscated VBScript script.