AsyncRAT Distribuido a Través de Campañas Amenazantes Temáticas de Inteligencia Artificial

«Diagrama de flujo del ataque

«graph TB %% Class Definitions Section classDef action fill:#99ccff classDef tool fill:#cccccc classDef malware fill:#ff9999 classDef process fill:#ccffcc classDef technique fill:#ffff99 %% Node Definitions %% Initial Stage action_user_exec[«Action – T1204.002 User Execution: Malicious File
User opens a compressed archive containing
a malicious .lnk shortcut disguised as an AI guide.»] class action_user_exec action action_obfuscation[«Action – T1027 Obfuscated Files or Information
The .lnk file uses cmd.exe to execute an
obfuscated command sequence to extract data
from a hidden PDF file named 3th.pdf.»] class action_obfuscation technique %% Staged Execution action_ps_decryption[«Action – T1027.013 Obfuscated Files or Information: Encrypted/Encoded File
A PowerShell script performs AES-CBC decryption
and Base64 decoding to reveal a payload
saved as Cache_{GUID}.ps1.»] class action_ps_decryption technique %% Persistence and Evasion action_persistence[«Action – T1547 Persistence
The script creates a scheduled task named
CheckRealtekAudioVersion to ensure survival.»] class action_persistence technique action_exclusion[«Action – T1679 Selective Exclusion
The malware uses Add-MpPreference to add
the C drive and powershell.exe to the
Microsoft Defender exclusion list.»] class action_exclusion technique %% Proxying and Scripting action_cmd_shell[«Action – T1059.003 Command and Scripting Interpreter: Windows Command Shell
Utilizes Windows Command Shell for execution.»] class action_cmd_shell technique action_syncappv[«Action – T1216.002 System Script Proxy Execution: SyncAppvPublishingServer
Uses a VBS file ResetRealtekAudioSettings64.vbs
to act as a mediator for launching batch files.»] class action_syncappv technique %% AutoHotkey Stage tool_autohotkey[«Tool: AutoHotkey.exe
Benign binary used to execute malicious
.ahk scripts for complex logic.»] class tool_autohotkey tool action_ahk_interpreter[«Action – T1059.010 Command and Scripting Interpreter: AutoHotKey & AutoIT
The .ahk scripts manage process injection
and orchestration.»] class action_ahk_interpreter technique %% Injection and Payload action_hollowing[«Action – T1055.012 Process Injection: Process Hollowing
Reconstructs a PE payload from text data
and injects it into legitimate .NET processes.»] class action_hollowing technique process_dotnet[«Process: .NET Process
Targeted legitimate process such as
AddInProcess32.exe for injection.»] class process_dotnet process malware_asyncrat[«Malware: AsyncRAT
A modular .NET Remote Access Trojan
deployed as the final payload.»] class malware_asyncrat malware action_exfiltration[«Action – T1048 Exfiltration Over Alternative Protocol
Exfiltrates system information and performs
surveillance via C2 domains like shampobiskworld.nl.»] class action_exfiltration technique %% Connections %% Initial chain action_user_exec –>|leads_to| action_obfuscation action_obfuscation –>|triggers| action_ps_decryption %% Persistence and Evasion chain action_ps_decryption –>|establishes| action_persistence action_ps_decryption –>|performs| action_exclusion %% Scripting and Proxying chain action_ps_decryption –>|leverages| action_cmd_shell action_cmd_shell –>|uses| action_syncappv %% AutoHotkey chain action_syncappv –>|executes| tool_autohotkey tool_autohotkey –>|uses| action_ahk_interpreter %% Injection chain action_ahk_interpreter –>|performs| action_hollowing action_hollowing –>|injects_into| process_dotnet %% Final Payload chain process_dotnet –>|hosts| malware_asyncrat malware_asyncrat –>|performs| action_exfiltration