When I first install an AsyncRAT.exe in target machine, I add this AsyncRAT.exe file location in target machine under WD exclusion, and add its shotcut to shell:startup. After running this exe, all the remote webcam, remote desktop and file manager features is functioning well. But once after target machine restart, AsyncRAT still able to connnect, due to my ngrok tcp, but when i try to use features like remote desktop, it replies "Could not load file or assembly '401920 bytes loaded from AsyncRAT, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null' or one of its dependencies. An attempt was made to load a program with an incorrect format." I confirms the 401920 bytes is exact size of my RemoteDesktop.dll from host machine AsnycRAT Plugins folder. Why is this happening? My target machine is not detecting any threats.
Asyncrat 0.5.8 Could not load file or assembly |
Jan 18, 2026 04:26 AM
(This post was last modified: Jan 18, 2026 04:35 AM by FaKeL.)
I have the same problem.
Trying async 5.9A and xworm 6. Before crypt i test him and everything working without any problem or errors. But after crypt almost all function not working and show me the same errors. Trying different systems (vmware ,real laptops with win 10 and win 11 and desktop pc with win 10) No detections from WD ,but not working properly. Any ideas? https://ibb.co/SwhHgj7p https://ibb.co/JWgk11Sk 
solution to your Problem : https://hackforums.net/showthread.php?tid=6313808
Jan 18, 2026 06:22 AM
(This post was last modified: Jan 18, 2026 09:55 AM by FaKeL.)
(Jan 18, 2026 04:50 AM)jmark7 Wrote: solution to your Problem : https://hackforums.net/showthread.php?tid=6313808 I tested with exactly the same version as i wrote above and it doesn't work.
Eeeeh, need to read source code on how AsyncRAT finds and loads the libraries (and maybe how it resolves entry points of the libraries, in the case when payload or library are getting obfuscated), might be that those parts of code are incompatible with some persistence or payload execution methods, or obfuscation by crypters/obfuscators.
(Jan 18, 2026 06:22 AM)FaKeL Wrote: I tested with exactly the same version as i wrote above and it doesn't work.
Jan 19, 2026 01:10 AM
(This post was last modified: Jan 19, 2026 01:12 AM by FaKeL.)
Now i test again Xworm 6 , 6.5 and Async 5.9A on vmware win 10.
After crypt on first run all plugins working,but after restart vmware plugins stop working and get errors. All three rats get the same errors. Please someone help me to fix this errors,or suggest me free rat that working without problems. With Pulsar i getting WD detection after run it.  (Jan 19, 2026 01:10 AM)FaKeL Wrote: Now i test again Xworm 6 , 6.5 and Async 5.9A on vmware win 10. What are the differences between first run and running after reboot? I assume first run might be from a different path than the one done by persistence on the second one. There shouldn't really be any difference in how the client is run, unless crypter is doing something really weird. So it's something about plugin location or reading of them. Try turning off WD and then testing. If it works after reboot with WD off, then it's blocking the plugins, and the plugins have to be cleaned. If still does not work, then it's a problem with how the client finds or loads plugins in different situations, need to debug or read the source. (Jan 19, 2026 06:17 AM)Binance Wrote: Your crypt loads into PE. If i understand correctly, the problem is in the crypter? The only plugin that works on this win11 is information. OS : Microsoft Windows 11 Pro SP0 x86 GPU : Parsec Virtual Display Adapter NVIDIA GeForce GT 730 Intel® UHD Graphics 630 CPU : Intel i3-8100 @ 3.60GHz Identifier : Intel64 Family 6 Model 158 Stepping 11 Ram : 15,8 GB Platform : Win32NT Ver : 10.0.26100.0 (Jan 19, 2026 07:54 AM)FaKeL Wrote: OS : Microsoft Windows 11 Pro SP0 x86 Um? I'm not sure if i understand this or if its correct. 32 bit windows 11? (Jan 19, 2026 07:54 AM)FaKeL Wrote: If i understand correctly, the problem is in the crypter? Could be. I cannot diagnose this without more information. Even with WD completely disabled, do all functions perform as expected? (apart from startup) (Jan 19, 2026 08:40 AM)Binance Wrote: Um? I'm not sure if i understand this or if its correct. 32 bit windows 11? I installed a completely new Windows 10 Pro on VMware, but I've been trying to completely turn off Defender for several hours now, but I can't. After restart, it turns back on 😡 And regarding this for windows 11 x86, this is seen in the Information plugin, but here it shows 11 x64. https://ibb.co/Qv4sndnV It's most likely a bug. (Jan 20, 2026 05:19 AM)FaKeL Wrote: I installed a completely new Windows 10 Pro on VMware, but I've been trying to completely turn off Defender for several hours now, but I can't. After restart, it turns back on 😡 Generally, you don't need to turn it completely off, just turn off real-time protection and all the other toggles on that page, it shouldn't turn back on its own. But you can go more hardcore and try tools like https://github.com/pgkt04/defender-control or https://github.com/es3n1n/defendnot . (Jan 20, 2026 08:32 AM)possessed-client Wrote: Generally, you don't need to turn it completely off, just turn off real-time protection and all the other toggles on that page, it shouldn't turn back on its own. But you can go more hardcore and try tools like https://github.com/pgkt04/defender-control or https://github.com/es3n1n/defendnot . Thanks for the advice. I turned off all WD features, the client connected and all plugins worked. I restarted the client computer and when it came back up all plugins worked. So for some reason WD is blocking plugins without notifying. Now the question is how to fix this?😕 |
|
|
