https://zviarcyber.github.io/tags/cyberchef/Recent content in Cyberchef on Blue Team Write-upsHugoen-usWed, 21 Jan 2026 00:00:00 +0000https://zviarcyber.github.io/posts/asyncrat-cyberdefenders/Wed, 21 Jan 2026 00:00:00 +0000https://zviarcyber.github.io/posts/asyncrat-cyberdefenders/<h2 id="scenario">Scenario</h2> <blockquote> <p>You are a cybersecurity analyst at Globex Corp. An employee opened an email attachment claiming to be an order specification, which actually carried a JavaScript file designed to deploy AsyncRAT. The malware evades detection efficiently. To secure the network, you must analyse the attachment, reverse-engineer AsyncRAT&rsquo;s obfuscation techniques, and determine the scope of the infiltration.</p></blockquote> <p><img alt="Scenario" loading="lazy" src="https://zviarcyber.github.io/img/asyncrat/01-scenario.png"></p> <p><strong>Tools used:</strong> <a href="https://obf-io.deobfuscate.io/">obf-io.deobfuscate.io</a>, <a href="https://gchq.github.io/CyberChef/">CyberChef</a>, DnSpy, the browser console, and PowerShell <code>Get-FileHash</code>.</p> <h2 id="investigation">Investigation</h2> <h3 id="q1-what-is-the-name-of-the-variable-that-conceals-the-obfuscated-code">Q1. What is the name of the variable that conceals the obfuscated code?</h3> <p>Opening the script, the malicious logic is buried under heavy obfuscation:</p>