Procedure examples

AsyncRAT can enumerate the NetBIOS name on targeted machines.

AsyncRAT can check if the current user of a compromised system is an administrator.

AsyncRAT can create a scheduled task to maintain persistence on system start-up.

AsyncRAT can capture keystrokes on the victim’s machine.

AsyncRAT can examine running processes to determine if a debugger is present.

AsyncRAT can be deployed via batch script.

AsyncRAT can proxy C2 through a Tor client.

AsyncRAT has the ability to download files including over SFTP.

AsyncRAT has the ability to use OS APIs including `CheckRemoteDebuggerPresent`.

AsyncRAT has the ability to view the screen on compromised hosts.

AsyncRAT can check whether the current system hour and day of the week are within operating hours defined it its configuration.

AsyncRAT can record screen content on targeted systems.

AsyncRAT has been executed through victims opening malicious file attachments.

AsyncRAT can identify strings such as Virtual, vmware, or VirtualBox to detect virtualized environments.

AsyncRAT can hide the execution of scheduled tasks using `ProcessWindowStyle.Hidden`.

AsyncRAT has been delivered via malicious email attachments.

AsyncRAT can be configured to use dynamic DNS.

AsyncRAT use a DGA to generate a C2 domains.

AsyncRAT can use the `CheckRemoteDebuggerPresent` function to detect the presence of a debugger.

AsyncRAT can check the disk size through the values obtained with `DeviceInfo.`