Hunting AsyncRAT & QuasarRAT

What it is

A DFIR hunting guide for AsyncRAT (and QuasarRAT), based on the author's inspection of the leaked AsyncRAT builder. It goes past listing IOCs to specify where artifacts land and how to pull them, which is what makes it actionable for a hunt.

How it works

AsyncRAT's persistence branches on privilege at install time — this is the one structural fact the summary flattens:

flowchart TD
    A[Installer runs] --> B{Admin privileges?}
    B -->|Yes| C[Scheduled Task created]
    B -->|No| D[Run key entry created]

Plugins (e.g. Recovery.dll from the "Password Recovery" function, the LimeLogger keylogger) are pushed from server to client and — per the author's Velociraptor MTF-Hunt — land directly under C:\, not in a subfolder. That path specificity is a concrete hunt target the summary omits.

Preconditions / Affected

Detection leans on attackers using builder defaults: the AsyncMutex_ prefix, ports 6606/7707/8808, and default drop directories. HP Security observed the default mutex in the wild, so this holds in real cases — but a builder edit or .NET obfuscation (a builder toggle) defeats string-based hunts.

What to do

Pull current AsyncRAT IOCs from ThreatFox:

curl -X POST https://threatfox-api.abuse.ch/api/v1/ -d '{ "query": "taginfo", "tag": "AsyncRAT", "limit": 1000 }'

• Velociraptor Mutants-Hunt: search string AsyncMutex_.
• Velociraptor MTF-Hunt: search for plugin DLL names dropped under C:\; the full plugin list is in AsyncRAT's public GitHub repo.
• Firewall logs: hunt IP-only domains connecting to high ports (>1024) — the author's 1000-sample analysis (Jan 2024) found all Bazaar samples used ports above 1024, and the default trio dominated. Expect high false-positive volume without process context.

Caveats

The author states this explicitly: the firewall-log approach returns many hits and is "a daunting task" without the process that created the connection. Port and mutex hunts only catch operators who left builder defaults — the post's whole framing (quoting Recorded Future) is that commodity RAT users often don't bother to change them, but nothing here catches one who did. A default-settings build already scores VT 48, so these samples are "anything but unknown" — signature-based detection may already cover the unmodified case.