AsyncRAT Hides in charmap.exe: How a Commodity RAT Mastered the…

A five-stage AsyncRAT campaign abuses AutoIt and PowerShell to inject its payload into charmap.exe, bypassing traditional file-based detection. The key is tracking behavioral chains, not static artifacts.

{"main_topic":"malware","topics":["malware","cybersecurity","infostealer","threat-intelligence"]}

On September 14, 2026, Point Wild Threat Intelligence researchers documented an AsyncRAT campaign that rewrites how commodity RATs evade defenses. The infection chain relies on no software vulnerabilities, instead orchestrating legitimate tools: a socially engineered batch file, hidden-window PowerShell, a signed AutoIt interpreter, and the Windows charmap.exe process as the final container. The result is an in-memory implant that PE-Sieve confirms with no corresponding file on disk.

Key Takeaways

The chain starts with a batch file disguised as an invoice, launches hidden PowerShell, and reconstructs the payload from ten Base64 fragments decrypted with a single-byte XOR key of 0x36.
A legitimate, renamed, and signed AutoIt interpreter executes an .ini loader script that decrypts a ~537 KB extensionless blob in memory.
The loader dynamically reconstructs Windows API names from XOR-encoded integer arrays, then injects the payload into charmap.exe via OpenProcess, VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread.
PE-Sieve detects modified CLR and AMSI modules in charmap.exe, indicative of in-process AMSI patching that obscures subsequent .NET activity.

A Signature Is No Longer Enough: When AutoIt Becomes a Vector

The initial vector is a batch file named "Right-click to open Invoice Details.bat." Social engineering drives the user to interact with a container that, upon opening, executes PowerShell with a hidden window and disabled profile. From there, payload reconstruction begins: ten Base64 fragments, stripped of junk characters, reassembled and decrypted with a single-byte XOR key of 0x36.

Three files appear on disk in an obfuscated subfolder under %LOCALAPPDATA%\Temp: ogftogcyiblzjccmcbnw.exe, a renamed AutoIt interpreter between 900 KB and 1 MB with a circular blue icon; kojuyn.ini, the loader script with an atypical extension; and nloemfbihmhm, an extensionless blob of approximately 537 KB containing the encrypted payload. Persistence is achieved via h73la8.bat in the Startup folder, requiring no registry keys or scheduled tasks: MITRE ATT&CK technique T1547.001, executable with standard user privileges.

The use of AutoIt as a container is deliberate. The interpreter is signed, known to allowlists, and often ignored by application control policies. The digital signature becomes a blind spot here: the tool is legitimate, the content is malicious, and the distinction demands behavioral analysis, not static inspection.

"The campaign demonstrates how commodity RAT operators are combining lightweight scripting and in-memory execution to defeat file-based detection" — Point Wild Threat Intelligence Researchers (via GBHackers)

From Loader to Injection: Five Stages of Evasion

The kojuyn.ini script contains no plaintext API names. According to the original Point Wild report, it dynamically reconstructs call strings from XOR-encoded integer arrays, frustrating simplified static analysis. Once executing, it decrypts the nloemfbihmhm blob in memory and launches %WINDIR%\SysWOW64\charmap.exe with a hidden window.

The process injection sequence follows: OpenProcess to obtain a handle to charmap.exe, VirtualAllocEx to allocate remote memory, WriteProcessMemory to write the decrypted payload, and CreateRemoteThread to transfer execution. PE-Sieve confirms a PE image implanted in charmap.exe with no matching file on disk. The final payload, Veukuzmw.dll, is AsyncRAT with screen-capture and information-stealing capabilities.

The choice of charmap.exe as a host process is tactically significant. It is a Microsoft-signed executable present in every Windows installation, rarely monitored closely. GBHackers researchers report the Point Wild analysis: "Using Character Map gives the malware a Microsoft-signed host process for its activity." The trust boundary between "signed = benign" and "Windows = normal" is exploited here to hide the implant in system noise.

AMSI Patching: The Final Veil Over .NET Activity

Post-injection detection often relies on AMSI, the Windows Anti-Malware Scan Interface, which intercepts and analyzes running scripts and .NET payloads. PE-Sieve detects modified CLR and AMSI modules in charmap.exe, indicative of in-process AMSI patching: the malware overwrites scanning functions in memory, eliminating visibility into subsequent RAT activity.

According to Cyber Security News, reporting the same Point Wild analysis: "The result is a malicious .NET program implanted in charmap.exe with no matching file left on disk." The combination of injection into a trusted process, absence of disk artifacts, and obfuscation of the security interface creates an extremely low detection profile for traditional defenses.

Command-and-control communication occurs over 158[.]51[.]122[.]136:4944, a defanged endpoint observed by researchers. The channel uses raw TCP, without application-layer protocols that might facilitate inspection.

What to Do Now

The campaign yields specific behavioral indicators that SOCs can translate into detection:

Correlate PowerShell executions with parent process cmd.exe or batch in a non-admin user context, particularly when associated with hidden windows.
Monitor writes to subfolders of %LOCALAPPDATA%\Temp with apparently random naming patterns, especially when involving .ini files and extensionless blobs.
Track execution of AutoIt.exe or renamed interpreters from user paths, with child processes including charmap.exe or other system executables with anomalous parents.
Implement periodic memory forensics on critical endpoints: PE-Sieve and similar tools detect implanted PE images with no disk counterpart, a condition unusual for legitimate processes.

Why Detection Must Shift from File to Behavior

The dossier does not specify the exact delivery vector of the initial batch — phishing email, link, or messaging platform are unconfirmed — nor the geography or targeted sectors. No attributions to specific threat actors emerge for this campaign, and the victim count is unquantified. The operation's start date remains unknown; the only certain date is the analysis publication on September 14, 2026.

What the report documents, however, is sufficient to trace an evolutionary line. Commodity RATs no longer require zero-days or sophisticated exploits; they require an understanding of operational trust boundaries, the gaps between signature and behavior, and the assumptions traditional defenses do not question. AutoIt's signature does not make its use in %TEMP% benign. charmap.exe's Microsoft signature does not make a remote memory allocation from a suspicious parent process normal.

The challenge for defenses is cultural before it is technical: abandon the equation "legitimate = safe" and build detection on behavioral chains that, in isolation, remain in the noise but together compose a recognizable infection chain.

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter