AsyncRAT Campaign Uses Trojanized ScreenConnect Installers and Open Directories
Summary
Hunt.io researchers traced AsyncRAT and a custom PowerShell RAT delivery campaign through trojanized ScreenConnect installers, open directories, ClickOnce redirects, and adaptable loaders with scheduled-task persistence and rotating C2 infrastructure.
Key points
- Researchers identified at least eight infrastructure hosts exposing staged payloads, including ScreenConnect-like installers, scripts, DLLs, and encoded payload containers.
- A recurring delivery chain used VBS or JavaScript to launch PowerShell loaders, with a police.html redirect leading to a ClickOnce-style executable.
- Loaders established persistence with scheduled tasks, including SystemInstallTask and 3losh, which ran as frequently as every two minutes.
- The malware used different execution paths: in-memory .NET assembly loading on some systems and DLL-assisted injection into a Windows process on others.
- Telemetry linked infrastructure to AsyncRAT activity across standard and high-numbered ports, with TLS observed on some connections.
- The report identifies indicators including Ab.vbs, Ab.js, Skype.ps1, libPK.dll, logs.* payload containers, and the /Bin/ URL pattern.
- Recommended defenses include restricting untrusted RMM installers and scripts, behavioral EDR monitoring, hunting the listed indicators, and enforcing MFA for vendor access.
Article Details
- Attack Vectors
- Trojanized ConnectWise ScreenConnect installers and ClickOnce executables were used to deliver staged payloads.
- Open directories hosted malware archives, loaders, scripts, DLLs, and payload containers.
- A VBS-to-LNK-to-PowerShell chain launched Skype.ps1; a JavaScript loader also launched PowerShell.
- PowerShell decoded payloads and either loaded .NET assemblies in memory or called libPK.dll::Execute to inject a payload into AppLaunch.exe.
- The scripts created recurring scheduled tasks named SystemInstallTask and 3losh for persistence.
- A police.html redirector forwarded visitors through galusa.ac.mz to a ClickOnce payload on dual.saltuta.com.
- The loaders checked for TotalAV or Avast, used an encoded AMSI bypass, and selected different execution paths based on detected security software.
- Defensive Notes
- Allowlist installers and RMM tools; validate signer metadata and verify installers through a separate vendor channel.
- Block or monitor /Bin/ download patterns and ClickOnce URLs, and alert on uncommon application/octet-stream responses.
- Use behavioral EDR detections for PowerShell Add-Type compilation, in-memory Assembly.Load, native export calls, and process injection.
- Restrict VBS, JavaScript, and PowerShell execution from publicly writable folders such as C:\Users\Public; enforce script-blocking policies.
- Harden endpoints with AppLocker or Device Guard, disable macros and legacy script hosts where feasible, and apply least privilege.
- Hunt for the reported loaders, payload containers, and URLs; coordinate infrastructure takedowns with hosting providers and CERTs.
- Enforce multi-factor authentication, rotate vendor and third-party credentials, and audit vendor access to management consoles.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | bahelp[.]top | Host of a campaign URL serving a ZoomWorkspace-themed installer. |
| DOMAIN | baquskreen[.]top | Host of a campaign URL serving a fake antivirus installer. |
| DOMAIN | con[.]wolonman[.]com | Host of a campaign URL serving a ScreenConnect installer. |
| DOMAIN | doc-sign[.]docsfinder[.]org | Host of a campaign URL serving an IRS-themed executable. |
| DOMAIN | docfileaccess[.]top | Host of a campaign URL serving a ScreenConnect application. |
| DOMAIN | dp[.]vdpanxxs[.]top | Short-lived domain recorded resolving to the AsyncRAT-associated host 45.74.16.71. |
| DOMAIN | dual[.]saltuta[.]com | Campaign payload host serving ScreenConnect-like installers and ClickOnce payloads. |
| DOMAIN | galusa[.]ac[.]mz | Campaign redirector domain forwarding visitors to the ClickOnce payload chain. |
| DOMAIN | mconnectsz[.]nsocumentzs[.]com | Host of a campaign URL serving a Zoom-themed installer. |
| DOMAIN | sc[.]vdpanxxs[.]top | Short-lived domain recorded resolving to the AsyncRAT-associated host 45.74.16.71. |
| DOMAIN | tulicrp[.]engajroker[.]cyou | Host of a campaign URL serving a support-themed executable. |
| DOMAIN | verify[.]uniupdate[.]net | Campaign-linked domain embedded in the ClickOnce payload URL parameters. |
| DOMAIN | vixgstxpnl[.]top | Disposable domain recorded resolving to the AsyncRAT-associated host 45.74.16.71. |
| DOMAIN | vn1backn[.]site | Host of a campaign URL serving a ScreenConnect application. |
| IPV4 | 164[.]68[.]120[.]30 | Open directory and AsyncRAT C2-associated host serving payloads. |
| IPV4 | 176[.]65[.]139[.]119 | Open directory and AsyncRAT-associated host serving staged malware. |
| IPV4 | 185[.]208[.]159[.]71 | High-risk AsyncRAT-associated host hosting staged payload containers. |
| IPV4 | 45[.]74[.]16[.]71 | Open directory and AsyncRAT-associated host serving staged malware. |
| IPV4 | 78[.]161[.]14[.]229 | Open directory hosting Ab.vbs and staged payload containers. |
| IPV4 | 78[.]162[.]57[.]179 | Open directory and AsyncRAT-associated host distributing payload containers. |
| IPV4 | 88[.]229[.]27[.]40 | Open directory and AsyncRAT-associated host distributing payload containers. |
| IPV4 | 94[.]154[.]173[.]145 | Host resolving to dual.saltuta.com, which served campaign installers. |
| MD5 | c596910b65fb3af81b9ca67ce11ebcc3 | Hash of the event_support-pdf.Client.exe ClickOnce dropper. |
| MD5 | cd5207483b78ef50d3dbd3f6a36d2a98 | Hash of Stub.exe, identified as a stager/dropper. |
| MD5 | f2d834d37efb0a74b944174edc88a984 | File artifact reported communicating with the AsyncRAT-associated host 176.65.139.119. |
| SHA256 | 0736e890f62b920c4489928254d5c0e5e67584dfb1c8649f08b62e400d28e882 | Hash of police.html, identified as the campaign redirector. |
| SHA256 | 1f7b509db8424453b8bb3a45053f3bc47f98414b168a67f253c10f0f6fb83936 | Hash of pe.txt, identified as an encoded AMSI-bypass payload. |
| SHA256 | 521769c955761f7fc625eae2006f4dabcf36ce3169309e0ad111e7b7b29748af | Hash of the weaponized Microsoft.lnk shortcut. |
| SHA256 | 54b762e05af1a1138786a78e9936d63f4e419bbeb0d116c2cee7376566420382 | Hash of the malicious Skype.ps1 PowerShell loader. |
| SHA256 | 5705e818447ec8f7c480a2bf28337b002d66b293b7450b7a993bf26ac9fee60f | Hash of q.txt, identified as an obfuscated configuration blob. |
| SHA256 | 6142295a7f7ce60b86738e07d79b72d5a3edb3d5915aa9fb6c81ea752a9cd229 | Hash of the Ab.vbs VBS loader. |
| SHA256 | 701e702f91942acef4d6afdda2abf70ed8618cde2f2ef3b174b092373c63c033 | Hash of a trojanized ScreenConnect installer. |
| SHA256 | 81aa861eb0fc8403e4a8be6f0f9eb8be494cc12571f98210e08a88d81a2c815c | Hash of a logs.idr runtime-parameter file variant. |
| SHA256 | 8d5b8061b3f6b899583bbf20e78c13bb2b44b9dff4c6c302c8c278725dc5a34d | Hash of a smaller Skype.ps1 PowerShell loader variant. |
| SHA256 | 98ef82f2f9861f1a0062a3c1b88184b28e6bf304856bfc6d8087ff28df113710 | Hash of the logs.idr runtime-parameter file. |
| SHA256 | 9cd11a25896a9e7a54aeaf0cc249a8ebcaada74168d2bdd2d51d8313a7293dce | Hash of a logs.idr runtime-parameter file variant. |
| SHA256 | ab2f559b05cfa32bc66c317260f51970699602ad06030e16bba66cf1bd20902f | Hash of a logs.idk payload-container variant. |
| SHA256 | aca3f0bf08779478f2b0ce7da16e8c87f8a860ae96d3e88d94c2907aae31ff0d | Hash of a logs.idk payload-container variant. |
| SHA256 | b97d0a646c8aece8f5c4cedb26da808ec5104038c7871ad0481f75df7a75c59d | Hash of libPK.dll, identified as a native injector DLL. |
| SHA256 | c7936cc04631bc9d4ed7a9be3a5638193fac57cb3ccfa7ce037aa2b0fe24cad7 | Hash of an Ab.vbs VBS loader variant. |
| SHA256 | cf9729e363562878a7027e0f8eab00d3853fe6a267fc654fae511a751cf6851a | Hash of the logs.idk/logs.ldk payload container. |
| SHA256 | e4afc06b31849f0a9c463e2599906a93914727a1f5b08d0ebfe1990965ebc41f | Hash of a logs.idr runtime-parameter file variant. |
| SHA256 | ec7514d1be0ba0b2a9059759d2885f81f1e887e1559a1630f6c380e11f7bf7d3 | Hash of logs.jpg, identified as a decoy image in the staged directory. |
| SHA256 | ff529b5e54b079ff9a449e933b6042c2403f15d0de9ee9dbfb0c51e56bf13fad | Hash of the encoded .NET payload in 1.txt. |
| URL | hxxp[:]//164[.]68[.]120[.]30:550 | Open directory identified as hosting a malicious toolkit. |
| URL | hxxp[:]//164[.]68[.]120[.]30:550/99/Skype[.]ps1 | Open-directory URL serving the malicious PowerShell loader. |
| URL | hxxp[:]//176[.]65[.]139[.]119:555 | Open directory identified as hosting a staged malware package. |
| URL | hxxp[:]//176[.]65[.]139[.]119:555/aA/Skype[.]ps1 | Open-directory URL serving the malicious PowerShell loader. |
| URL | hxxps[:]//45[.]74[.]16[.]71 | Open directory identified as hosting malicious archives and staged payloads. |
| URL | hxxps[:]//45[.]74[.]16[.]71/aAold/Skype[.]ps1 | Open-directory URL serving the malicious PowerShell loader. |
| URL | hxxps[:]//bahelp[.]top/Bin/ZoomWorkspace[.]ClientSetup[.]exe?e=Access&y=Guest | Campaign URL serving a ZoomWorkspace-themed installer. |
| URL | hxxps[:]//baquskreen[.]top/Bin/ANTI%20VIRUS%20UPDATE[.]ClientSetup[.]exe | Campaign URL serving a fake-antivirus-themed executable. |
| URL | hxxps[:]//con[.]wolonman[.]com/Bin/ScreenConnect[.]ClientSetup[.]exe | Campaign URL serving a ScreenConnect installer. |
| URL | hxxps[:]//doc-sign[.]docsfinder[.]org/Bin/IRScasedocs5Nhd8fMGaUr0Ts1o6qlE[.]Client[.]exe?h=wise[.]access[.]ly&p=8041&k=ENCODE&s=7b6d96a8-dcac-4f65-aaec-6e3d4b1ed22f&i=Untitled%20Session&e=Support&y=Guest&r= | Campaign URL serving an IRS-themed executable. |
| URL | hxxps[:]//docfileaccess[.]top/Bin/ScreenConnect[.]Client[.]application?e=Support&y=Guest | Campaign URL serving a ScreenConnect application. |
| URL | hxxps[:]//dual[.]saltuta[.]com/Bin/event_support-pdf[.]Client[.]exe?h=verify[.]uniupdate[.]net&p=8041&k=BgIAAACkAABSU0ExAAgAAAEAAQDRensUJhLSOFlnmqiCZ1BBEo1jqzYsqCiPY8zJL%2B9sTvN8rOqDMiuFVCF7jN3iOlyetxlsikbfRVF1Ij6H08xEdkxwJBI3fbDQBxhNrYcQuF%2F3ijT9QF5aMNmVAoQxNVM2OOt%2BWUVSJe4EiEkuQwmBkIjXyDwC8DMM5U%2FjTbS%2BFcfLmNpfJLntQwWHmI9QGJFAgcQ2slNUZSRMzb%2F7Ur9lDT40V%2BbkQB9PmiBiIN8gp9rVo4A7CDUNVkeYH0u8Vo5jzaAxm9DDauyHYsh7o7qFxZ1McroHJr5HRLHfkavFsgZ00IINf6PZpcZ71GVfyiMPJQSGEusPTYb8WDCsj%2B%2Bm&s=39a2421c-4014-42f5-b668-addee4113978&i=untitled&e=Support&y=Guest&r= | Specific campaign URL identified as delivering the event_support-pdf.Client.exe ClickOnce dropper. |
| URL | hxxps[:]//galusa[.]ac[.]mz/pdf | Malicious redirector resource forwarding visitors into the campaign payload chain. |
| URL | hxxps[:]//mconnectsz[.]nsocumentzs[.]com/Bin/ZOOM[.]ClientSetup[.]exe?e=Access&y=Guest | Campaign URL serving a Zoom-themed installer. |
| URL | hxxps[:]//tulicrp[.]engajroker[.]cyou/Bin/support[.]Client[.]exe | Campaign URL serving a support-themed executable. |
| URL | hxxps[:]//vn1backn[.]site/Bin/ScreenConnect[.]Client[.]application?y=Guest | Campaign URL serving a ScreenConnect application. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationEncoded .NET assemblies and payload blobs were reconstructed or decoded from files including 1.txt, pe.txt, logs.ldk, and logs.ldr.T1053.005 · Scheduled TaskThe loaders created recurring scheduled tasks named SystemInstallTask and 3losh.T1055 · Process InjectionlibPK.dll::Execute injected a decoded payload into AppLaunch.exe.T1059.001 · PowerShellSkype.ps1 and other PowerShell commands executed the loaders and payload stages.T1059.005 · Visual BasicAb.vbs used WScript.Shell to launch the shortcut and continue the infection chain.T1059.007 · JavaScriptAb.js used ActiveXObject to launch PowerShell.T1105 · Ingress Tool TransferThe ClickOnce redirect chain delivered event_support-pdf.Client.exe as a first-stage payload.T1562.001 · Disable or Modify ToolsThe scripts used an AMSI bypass and invoked PowerShell with execution-policy bypass.T1620 · Reflective Code LoadingThe loaders decoded .NET assemblies and executed payloads in memory using Assembly.Load or a dynamically loaded assembly.
CVE
Malware
Vendors
Products
Avastminutes.The script then checks for the presence of security software, specifically looking for TotalAV or Avast installations. If either is found, it loads pe.txt, which contains an obfuscated assembly encoded asConnectWise ControlRecent investigations uncovered how attackers are abusing ConnectWise ScreenConnect (formerly ConnectWise Control) installers to deliver AsyncRAT payloads, leveraging open directories as staging points. By pivotingConnectWise ScreenConnectRemote Monitoring and Management (RMM) tools like ConnectWise ScreenConnect have become both indispensable for IT administrators and highly attractive to threat actors targeting organizations in the United States.TotalAVevery two minutes.The script then checks for the presence of security software, specifically looking for TotalAV or Avast installations. If either is found, it loads pe.txt, which contains an obfuscated assembly
Tools
Countries
GermanyIP 176.65.139[.]119 (Germany) Open dirSwitzerlandTurkeyIP 78.161.14[.]229:753 (AS9121 - Turkey) Open dirUnited Statesfor IT administrators and highly attractive to threat actors targeting organizations in the United States. ScreenConnect's deep system access, trusted installation footprint, and widespread use across managed