Kiran 
A newly documented AsyncRAT campaign is using a legitimate, digitally signed AutoIt interpreter and Windows’ built-in Character Map utility to smuggle a full-featured remote access trojan past traditional antivirus defenses, according to research published by Point Wild’s Lat61 Threat Intelligence Team.
The infection begins with a file bearing a deliberately misleading name: “Right-click to open Invoice Details.bat.” Once executed, the batch script launches PowerShell with a hidden window and a disabled profile, immediately reducing any visible trace of activity.
From there, it reassembles a Base64-encoded payload stitched together from ten separate variable fragments, a technique specifically designed to defeat static string-matching scanners.
AsyncRAT Hides Inside Windows Character Map
Deliberately inserted junk characters, asterisks in one layer and question marks in another, further corrupt the Base64 pattern until they’re stripped out at runtime.
The cleaned data is then decoded and passed through a repeating-key XOR routine, which researchers describe as barely qualifying as encryption because the 16-byte key sits in plaintext directly above the decryption loop.
The script drops three files into a randomly named subfolder under %LOCALAPPDATA%\Temp: a renamed but unmodified, legitimately signed AutoIT interpreter; a companion loader script named kojuyn.ini; and an extensionless 537 KB file containing encrypted shellcode.
A batch file also lands in the user’s Startup folder, guaranteeing the malicious pair relaunches at every logon without touching the registry or Task Scheduler, a lightweight persistence method that requires no elevated privileges.
The kojuyn.ini script does the real evasion work. The script rebuilds every API name and constant, including OpenProcess, VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread, at runtime from XOR-encoded integer lists rather than as readable text.
The script decrypts the payload in memory using a single-byte XOR key and injects it into %WINDIR%\Syswow64\charmap.exe, Microsoft’s signed Character Map process, via the classic OpenProcess-to-CreateRemoteThread chain.
Memory forensics tool PE-Sieve confirmed a fully implanted PE image inside charmap.exe with no corresponding file on disk, alongside evidence that both the .NET CLR and AMSI’s scanning function had been hooked, effectively blinding Windows’ built-in malware scanner to what loaded next.
“What stands out here isn’t novel malware code, it’s novel patience,” one might observe about this campaign. Attackers increasingly favor legitimate, signed binaries as camouflage precisely because defenders trust them by default; the real innovation is architectural discipline in hiding a commodity RAT behind clean, trusted infrastructure.
Subsequent stages decrypt progressively until a final .NET DLL, identified as Veukuzmw.dll, loads directly into memory inside charmap.exe.
This payload is a recognizable AsyncRAT build equipped with screen-capture functionality using Graphics.CopyFromScreen(), image compression, and command-and-control communication over raw TCP to 158.51.122.136 on port 4944, an unencrypted, custom-protocol channel rather than traffic disguised as HTTPS.
Mitigation
Because outbound network activity originates from a trusted, Microsoft-signed process, standard reputation-based detection largely fails.
Researchers mapped the chain across MITRE ATT&CK techniques including T1566.001 (phishing), T1547.001 (Startup folder persistence), and T1055.002 (PE injection), and recommend security teams focus detection on the initial batch file and PowerShell behavior rather than downstream in-memory activity, since the payload never touches disk once inside charmap.exe.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
George antony 
