Null-AMSI Evading Security To Deploy AsyncRAT

This CRIL report describes a malicious campaign that uses deceptive LNK wallpaper shortcuts to launch obfuscated PowerShell scripts that download additional stages, bypass AMSI and ETW using a Null‑AMSI-style technique (noted to contain Portuguese comments), decrypt AES/GZIP-encoded payloads in memory, and ultimately load AsyncRAT for remote access; the report provides detailed technical analysis, persistence and evasion techniques, IOCs (file hashes, URLs, and a C2 IP), and recommended mitigations.