Security researchers have uncovered a widespread campaign that uses the legitimate remote access tool ScreenConnect, disguised as freeware, to compromise systems and deploy the AsyncRAT malware. The campaign involves numerous spoofed websites mimicking popular software downloads, which deliver malicious archives containing the ScreenConnect installer alongside other components.
The investigation began when a Kaspersky Managed Detection and Response (MDR) team observed suspicious PowerShell and VBScript activity originating from a ScreenConnect process. This initial incident revealed a much larger operation where threat actors were distributing malicious installer archives. These archives were designed to appear as legitimate installers for software such as OBS Studio, DNS Jumper, DS4Windows, and Bandicam.
These fake installer archives typically contain a legitimate, digitally signed Microsoft `install.exe` binary and a malicious library named `install.res.1033.dll`. The `install.exe` is often renamed to match the purported software, for example, `OBS-Studio-Installer.exe`. When executed, the `install.exe` loads the rogue `install.res.1033.dll` through a DLL sideloading technique. This malicious library then proceeds to install the ScreenConnect remote administration tool.
The ScreenConnect service, once installed, is configured to await further instructions from the attackers. In the observed incidents, the ScreenConnect process spawned PowerShell scripts that disabled User Account Control (UAC) by modifying the `ConsentPromptBehaviorAdmin` registry parameter to `0`. These scripts also configured Microsoft Defender exclusions for all system disks, root directories, and the `RegAsm.exe` process, aiming to evade detection.
Following these preparatory steps, a VBScript file, often named `script.vbs`, is created and executed. This script terminates any active `powershell.exe` processes and then executes another script, `cap.ps1`, in a hidden window. `cap.ps1` reads encrypted data from a file (e.g., `secret_bytes.txt`), decrypts it using an XOR key, and reconstructs a Portable Executable (PE) binary.
This reconstructed binary is then loaded into memory using a process hollowing technique. The attackers launch a legitimate `RegAsm.exe` process in a suspended state, inject the decrypted PE binary into its address space, and resume the process. This effectively replaces the original `RegAsm.exe` functionality with the injected code, which in this campaign, is the AsyncRAT remote access Trojan.
To ensure persistence, the malware establishes a scheduled task named `MasterPackager.Updater`. This task is configured to run every two minutes, executing the `script.vbs` file, thereby ensuring the entire infection chain can be re-initiated even after a system reboot. Once established, the compromised `RegAsm.exe` process connects to a command and control (C2) domain, such as `mora1987[.]work[.]gd`, to receive further instructions.
The initial entry point for ScreenConnect installation was identified as a user-downloaded archive, for instance, `obs-studio-windows-x64.zip`, obtained from a typosquatted domain like `www.studioobs[.]com`, which impersonates the official OBS Studio website. These malicious domains are often discoverable through search engine results, leading unsuspecting users to download the compromised installers.
The malicious archives were found to contain not only the fake installer and the malicious DLL but also a copy of the legitimate software being impersonated and the ScreenConnect utility itself. The ScreenConnect installation within the archive often utilized native Windows utilities like `msiexec.exe`, with standard MSI packages renamed to appear as DLL files.
The campaign is notable for its extensive infrastructure, with researchers uncovering over 90 domain names localized across 10 different languages. These spoofed websites consistently followed the same pattern of delivering a hidden ScreenConnect service under the guise of a software installer, enabling attackers to maintain control over compromised endpoints, which included both individual users and organizations. Kaspersky solutions detect ScreenConnect as `not-a-virus:HEUR:RemoteAdmin.MSIL.ConnectWise.gen`.
