ScreenConnect SEO-Poisoning → AsyncRAT

A large, multi-language malware-distribution operation drives users to 90+ look-alike download sites (localized across at least 10 languages) through search-engine poisoning, serving installer archives that impersonate popular free software — OBS Studio, Bandicam, DS4Windows, DNS Jumper, Process Hacker and dozens of gaming titles. The archive bundles a legitimately signed Microsoft install.exe with a rogue install.res.1033.dll loaded via DLL side-loading, which quietly stands up a rogue ScreenConnect remote-access instance for hands-on control.

From ScreenConnect the actor runs a PowerShell dropper (Fj5NmEsp9EuKrun.ps1) that adds Microsoft Defender exclusions for whole drive roots and disables UAC (ConsentPromptBehaviorAdmin=0), writes a VBScript (installer_method3_stream.vbs / script.vbs) that XOR-decodes (key 0xA7) and reflectively loads a payload, and finally process-hollows RegAsm.exe to run AsyncRAT. Persistence is a scheduled task MasterPackager.Updater firing every two minutes. Reported by Kaspersky/Securelist and corroborated by The Hacker News on 2026-07-01.

Defender priority: The strongest, lowest-FP signals are the unique dropper artifacts and the anomalous execution graph — a signed install.exe side-loading install.res.1033.dll, PowerShell adding a drive-root Defender exclusion, and RegAsm.exe beaconing outbound. Hunt those three first; they fire on the behavior even after the actor rotates C2 domains.

Campaign was observed active Oct 2025 → end of Mar 2026 with a lull, resurfacing in coverage 2026-07. Atomic C2/domain IOCs are perishable; the behavioral hunts (§8 Q1–Q7) are the durable coverage.

Hunt hypotheses (fidelity-ordered)

1. H1 (high): The rogue side-load DLL install.res.1033.dll is written to disk beside a signed installer. Unique filename → near-zero FP.
2. H2 (high): The named PowerShell dropper Fj5NmEsp9EuKrun.ps1 executes. Unique string.
3. H3 (high): A persistence task MasterPackager.Updater is registered to run a C:\Users\Public VBScript every 2 minutes.
4. H4 (high): RegAsm.exe — a local .NET build tool — makes outbound network connections (hollowed AsyncRAT beacon).
5. H5 (medium): PowerShell adds a Defender exclusion for a drive root or for RegAsm.exe.
6. H6 (medium): UAC admin-consent is disabled via ConsentPromptBehaviorAdmin.
7. H7 (medium): wscript.exe/cscript.exe runs a .vbs out of C:\Users\Public.
8. H8 (high, perishable): Endpoints resolve campaign C2 / rogue-ScreenConnect domains.

Attack chain

Provenance: every atomic IOC below is drawn from the Securelist/Kaspersky and The Hacker News reports (2026-07-01). install.exe (MD5 87603EA0…532048) is the legitimate, Microsoft-signed host binary abused for side-loading — do not block it; hunt the rogue DLL beside it instead.

• Windows Security 4698 (scheduled task created) — filter TaskName MasterPackager.Updater or any task launching wscript.exe against C:\Users\Public\*.vbs.
• Microsoft Defender Operational log 5007 (config change) and 5001/1121 — a new exclusion path/process, especially a drive root (C:\, D:\) or RegAsm.exe.
• Sysmon EID 7 (image load) — install.res.1033.dll loaded by a signed install.exe; EID 1 — RegAsm.exe spawned by wscript.exe/powershell.exe with no build arguments.
• Registry audit — writes to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin.
• Web proxy / SWG — downloads of installer archives from look-alike free-software / gaming domains; connections to the C2 and download hosts in §4.
• RMM inventory — any ScreenConnect / ConnectWise Control instance not registered to your sanctioned tenant.

Promote Q1, Q5 and the RegAsm-lineage IOA to prevention after one clean baseline window; keep Q3/Q4 as detect-only until benign UAC/Defender-exclusion writers in your estate are enumerated.

type,value,action,severity,expiration,description,tags
domain,mora1987.work.gd,detect,critical,2027-01-03,AsyncRAT C2,campaign:ScreenConnectAsyncRAT
domain,servermanagemen.xyz,detect,high,2027-01-03,rogue ScreenConnect C2,campaign:ScreenConnectAsyncRAT
domain,manage-server.xyz,detect,high,2027-01-03,rogue ScreenConnect C2,campaign:ScreenConnectAsyncRAT
domain,manageserver.xyz,detect,high,2027-01-03,rogue ScreenConnect C2,campaign:ScreenConnectAsyncRAT
domain,managedevice.xyz,detect,high,2027-01-03,rogue ScreenConnect C2,campaign:ScreenConnectAsyncRAT
domain,winservec.net,detect,high,2027-01-03,rogue ScreenConnect C2,campaign:ScreenConnectAsyncRAT
domain,serverdnsplan.net,detect,high,2027-01-03,rogue ScreenConnect C2,campaign:ScreenConnectAsyncRAT
domain,cloudsynn.com,detect,high,2027-01-03,rogue ScreenConnect C2,campaign:ScreenConnectAsyncRAT
domain,pingserv.pro,detect,high,2027-01-03,rogue ScreenConnect C2,campaign:ScreenConnectAsyncRAT
domain,pingpanl.pro,detect,high,2027-01-03,rogue ScreenConnect C2,campaign:ScreenConnectAsyncRAT
domain,ehostservers.xyz,detect,high,2027-01-03,rogue ScreenConnect C2,campaign:ScreenConnectAsyncRAT
domain,edgeserv.ru,detect,high,2027-01-03,rogue ScreenConnect C2,campaign:ScreenConnectAsyncRAT
domain,fileget.loseyourip.com,detect,high,2026-10-03,payload download host,campaign:ScreenConnectAsyncRAT
domain,direct-download.giize.com,detect,high,2026-10-03,payload download host,campaign:ScreenConnectAsyncRAT
ipv4,185.254.97.249,detect,high,2026-10-03,ScreenConnect C2,campaign:ScreenConnectAsyncRAT
ipv4,45.145.41.205,detect,high,2026-10-03,ScreenConnect C2,campaign:ScreenConnectAsyncRAT
ipv4,162.216.241.242,detect,medium,2026-10-03,distribution cluster,campaign:ScreenConnectAsyncRAT
ipv4,198.23.185.81,detect,medium,2026-10-03,distribution download,campaign:ScreenConnectAsyncRAT
ipv4,2.59.134.97,detect,medium,2026-10-03,distribution cluster,campaign:ScreenConnectAsyncRAT

5F96C04E3AFAE97017B201BE112284D2
73BEAD922109A61E5F9F85771A7812C5
EDFF4F58722C93D7C09ED71899416396
83601C3D4ED28E8D2BE1B99BEB8EC18C
695E794631EF130583368770E7B81E98
1E6A5C7B620D487D0CFC6874C3B77C90
54025CE2A9405039899FE99A1D77E0BB
BD05FCF80E493CF9AA71EC510319469D
999A63730C9634481D1D76955A2E76A8
479BD3BB617B39CD4A46D0768A2592D4
776DFD3DF9C04BB9FCDD6C1880C3761A
8E4C57358A66EB14D31ABB614DDC68DE
A40D3AEB0DAE5B00BDB3A517F3135BBB
A85A5BFDCB7C65AB93043B8CF9E20065
01325880EFFFEC546F59490089A3B415

Rogue DLL: install.res.1033.dll written beside a signed install.exe
Dropper: powershell running Fj5NmEsp9EuKrun.ps1
Evasion: Add/Set-MpPreference exclusion for drive root or RegAsm.exe
UAC: ConsentPromptBehaviorAdmin set to 0 by user-mode script
Loader: wscript running C:\Users\Public\*.vbs (script.vbs, installer_method3_stream.vbs)
Hollowing: RegAsm.exe launched by wscript/powershell, then egresses
Persistence: scheduled task MasterPackager.Updater, MINUTE /MO 2
Staged files: C:\Users\Public\{msgbox.txt,secret_bytes.txt,1.vb,cap.ps1}
Payload crypto: XOR key 0xA7 with bit-order inversion (cap.ps1)

[ ] Inventory all ScreenConnect/ConnectWise Control instances; block non-sanctioned
[ ] Enable Defender Tamper Protection (blocks exclusion tampering)
[ ] ASR: Block executable files unless prevalence/age/trusted-list criteria met
[ ] ASR: Block process creations from PSExec/WMI; block obfuscated scripts
[ ] UAC: EnableLUA=1, ConsentPromptBehaviorAdmin=2 (locked via GPO/MS baseline)
[ ] WDAC/AppLocker: deny exec from %PUBLIC%, %TEMP%, %USERPROFILE%\Downloads
[ ] SmartScreen enforced for Edge + Explorer
[ ] Block campaign C2/download domains + IPs at DNS/proxy (see CSV)

install.exe (MD5 87603EA025623B19954E460ADD532048) is the legitimate signed Microsoft binary abused as the side-load host — it is intentionally excluded from the block set.

1 · Enable Tamper Protection + ASR rules (PowerShell, admin)

# Tamper Protection is enabled via Intune/MDE policy; verify locally:
Get-MpComputerStatus | Select-Object IsTamperProtected

# Enable high-leverage ASR rules in Block mode
$asr = @(
  "01443614-cd74-433a-b99e-2ecdc07bfc25",  # Block executables by prevalence/age/trust
  "d1e49aac-8f56-4280-b9ba-993a6d77406c",  # Block process creations from PSExec/WMI
  "5beb7efe-fd9a-4556-801d-275e5ffc04cc"   # Block obfuscated scripts
)
foreach ($id in $asr) { Add-MpPreference -AttackSurfaceReductionRules_Ids $id -AttackSurfaceReductionRules_Actions Enabled }

2 · Lock UAC (registry / GPO)

reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 2 /f
# Enforce via GPO: Computer Config > Policies > Windows Settings > Security Options
#   "User Account Control: Run all administrators in Admin Approval Mode" = Enabled

3 · AppLocker deny rule for user-writable paths (policy XML fragment)

<!-- Deny EXE/DLL execution from Public/Temp/Downloads -->
<FilePathRule Id="a1e0-public-deny" Name="Deny %PUBLIC% exec" Action="Deny" UserOrGroupSid="S-1-1-0">
  <Conditions><FilePathCondition Path="%PUBLIC%\*"/></Conditions>
</FilePathRule>
<!-- Repeat with Path="%OSDRIVE%\Users\*\Downloads\*" and enable the DLL rule collection -->

4 · Remove the persistence + staged artifacts (post-detection, admin)

schtasks /delete /tn "MasterPackager.Updater" /f
Remove-Item "C:\Users\Public\script.vbs","C:\Users\Public\cap.ps1","C:\Users\Public\1.vb","C:\Users\Public\secret_bytes.txt","C:\Users\Public\msgbox.txt" -ErrorAction SilentlyContinue
# Remove any attacker-added Defender exclusions, then re-run Q3 to confirm none remain

Primary gap: the delivery step (T1189) is not visible to EDR; cover it with web-proxy / secure-web-gateway logging (§7) and user-awareness controls (§12). C2 domain coverage (Q8) is durable only while the intel is fresh — lean on the behavioral queries Q1/Q5/Q7 for lasting detection. Validation gates in §11 must pass before promoting any query to prevent.