MalwarePublished 26 May 2025

Reborn in Rust: Attempt to thwart malware analysis

Source AlienVault OTX General

Description

AsyncRAT, a remote access trojan known since 2019, has been rewritten in Rust, marking a shift from its original C# implementation. This change aims to complicate reverse engineering efforts due to limited analysis tool support for Rust. The malware retains its core functionality, including plugin installation, code execution, and persistence. It installs via scheduled tasks or temporary directory copying, stores plugins in the registry, and communicates with command and control servers over TLS. The Rust variant supports fewer commands compared to its .NET counterpart, suggesting ongoing development. The malware collects system information, including hardware ID, OS details, and antivirus software presence. Debug strings in the samples indicate active development of this Rust version.

Impact

For European organizations, the emergence of AsyncRAT rewritten in Rust presents a nuanced threat. The use of Rust complicates traditional malware analysis and detection, potentially allowing infections to persist longer undetected. Organizations relying on endpoint detection and response (EDR) tools optimized for .NET or C# malware may experience reduced detection efficacy. The RAT's capability to install plugins and execute arbitrary code means attackers can customize payloads for espionage, data exfiltration, or lateral movement within networks. The collection of system and antivirus information enables attackers to identify high-value targets and evade security controls. The use of TLS for C2 communications further hinders network-based detection. While no widespread exploitation is currently reported, the active development status suggests the threat could escalate. European sectors with critical infrastructure, government agencies, and enterprises with sensitive intellectual property are at risk of targeted attacks leveraging this RAT. The medium severity rating reflects the current limited command set and lack of known exploits but underscores the need for vigilance as the malware evolves.

Defensive guidance

To mitigate the threat posed by the Rust variant of AsyncRAT, European organizations should implement targeted strategies beyond generic best practices. First, enhance endpoint monitoring to include heuristic and behavioral analysis capable of detecting suspicious scheduled task creation and unusual registry modifications, particularly those involving plugin storage. Deploy advanced threat detection solutions that incorporate Rust binary analysis capabilities or integrate threat intelligence feeds containing the provided IOCs (file hashes and C2 domains) for proactive blocking. Network defenses should be configured to monitor and inspect TLS traffic for anomalies, using SSL/TLS interception where legally permissible, to detect encrypted C2 communications. Implement strict application whitelisting to prevent unauthorized execution of unknown binaries, especially in temporary directories. Regularly audit scheduled tasks and registry keys for unauthorized entries. Employ threat hunting exercises focusing on the identified domains and hashes. Additionally, maintain up-to-date asset inventories to correlate hardware IDs and OS details collected by the malware, facilitating anomaly detection. Finally, collaborate with cybersecurity information sharing organizations to stay informed about updates to AsyncRAT’s capabilities and emerging detection techniques.

Indicators of compromise

Domains 3

backup-tlscom.sytes.net
magic-telecom.ddns.net
mohsar.ddns.net

Hashes 3

6e30074c693574294be7ed2aea600afe
7914e60dda14160299423bcdf6d01a473387d2e0
eb12c198fc1b6ec79ea4b457988db4478ee6bc9aca128aa24a85b76a57add459

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 25 Jun 2025, 15:31 UTC

MITRE ATT&CK techniques12 from threat tags

Technical details

Indicators of compromise

Domains 3

Hashes 3

Community reviews

Related threats