AsyncRAT screen-capture routine referencing CopyFromScreen/CaptureScreen

Ankit Mehta@Secvyn

•updated 25 days ago•0•0•1

Detects the presence of AsyncRAT's screen-capture functionality, specifically the use of .NET Graphics.CopyFromScreen and MemoryStream routines, identified via Microsoft Antimalware Scan Interface (AMSI) inspection logs within a host process.