Researchers Reversed Asgard Malware Protector to Uncover it’s Antivirus Bypass Techniques
Recent analyses have highlighted the capabilities of Asgard Protector , a sophisticated crypter utilized by cybercriminals to obfuscate and deploy malicious payloads. First introduced in late 2023, this tool has become integral to threat actors due to…
Recent analyses have highlighted the capabilities of Asgard Protector , a sophisticated crypter utilized by cybercriminals to obfuscate and deploy malicious payloads. First introduced in late 2023, this tool has become integral to threat actors due to its compatibility with popular command-and-control platforms, such as LummaC2.
Asgard Protector functions by embedding infostealers and remote access trojans within seemingly harmless installers, effectively bypassing traditional antivirus defenses. The toolkit is typically delivered as a Nullsoft self-extracting archive. Upon execution, it unpacks several hidden components into the temporary directory.
SpyCloud researchers have observed that the installer disguises its batch script with misleading file extensions, such as renaming a .bat file to Belgium.pst , and employs obfuscation techniques to obscure its true intent. The installer then assembles an AutoIt interpreter binary in memory, using components from embedded CAB archives to reconstruct the executable before initiating the next stage.
Additional evasion layers have been identified within the embedded AutoIt scripts. Encrypted payloads are stored within the script and decrypted in memory using an RC4 routine. Following decryption, the binary is decompressed using the LZNT1 algorithm and injected into explorer.exe , thereby concealing the malicious process within a trusted system host.
The toolkit is typically delivered as a Nullsoft self-extracting archive.
Furthermore, the malware incorporates a sandbox-detection mechanism that issues a ping to a randomly generated domain, terminating if a response is detected, indicating a monitored environment. Following unpacking and validation, the malicious payload achieves persistence by modifying autorun registry keys or deploying scheduled tasks, contingent on the operator's configuration.
The infection mechanism of Asgard Protector involves a Nullsoft installer script that utilizes simple but effective obfuscation techniques:
findstr /b /r /c:"MZ" *.dat > offset.txt for /f "tokens=1" %%A in (offset.txt) do set /A start=%%A certutil -decode input.cab temp.exe fsutil file createnew stub.bin %start% more +%start% input.cab >> stub.bin
This script identifies the “MZ” header within a CAB archive to locate the PE header's beginning. The extracted data is concatenated past this offset to reconstruct the AutoIt binary. Once assembled, the script executes a companion AutoIt script that orchestrates RC4 decryption and LZNT1 decompression before injecting the payload into memory.
This modular assembly and execution model allows the malware to bypass signature-based antivirus engines and evade disk-based inspection tools.
Based on reporting by Cyber Security News.