Statik Analiz — AsyncRAT | HOCH | CVSS: 7.5

Datei

SHA2560001b8219a77f8e206efe2b71ecf3892aed755c26fb2dc5e4b7b42a226b72eaa
MD532066ff6369a7bd794f03bdb77c399f3
Datei0001b8219a77f8e206efe2b71ecf3892aed755c26fb2dc5e4b7b42a226b72eaa.exe
Größe4,486,656 byte
TypPE32+ executable for MS Windows 6.02 (DLL), x86-64, 7 sections
Stringler15,296

Bölümler

AdEntropi
.text5.7
.rdata5.47
.data6.01
.pdata5.53
.didat4.04
.rsrc5.12
.reloc5.59

IOC

SHA2560001b8219a77f8e206efe2b71ecf3892aed755c26fb2dc5e4b7b42a226b72eaa
MD532066ff6369a7bd794f03bdb77c399f3
IP5.2.3.5, 1.2.3.4, 5.5.8.2, 4.0.0.0, 1.3.6.1, 5.5.7.3, 158.69.36.15, 194.5.212.124
Domaingithub.com, module-compiler.cc, ystem.net, system.net, hirr.com, erry-dibbert16ih.ru, encryptor.cc, githubusercontent.com
C21.2.3.4:5678, github.com, module-compiler.cc, ystem.net, system.net, hirr.com

AsyncRAT — Malware-Profil

AsyncRAT, 2019'da acik kaynak olarak yayimlanan C# tabanli RAT ailesidir. Ekran yakalama, keylogger, dosya islemleri, HVNC ve plugin sistemine sahiptir. C2 AES-128-CBC ile sifrelenir, TCP uzerinden calisir. JS/PDF yemi ile dagitilir.

Malware-Typ
RAT
Programmiersprache
.NET C#
C2-Protokoll
TCP/SSL
Zielsysteme
Windows
Auch bekannt als (AKA)
AsyncClient

Technische Details

C# .NET, AES-128-CBC sifreleme, TCP port 6606/4449 (varsayilan), Mutex kontrol, Runtime assembly loading, Anti-analysis (VM check, Process listesi), HVNC, Keylogger, Stealer, Botnet modulu

Attribution / Bedrohungsakteur

Acik kaynak - orjinal gelistirici GitHub'da yayinladi; surekli siber suclu toplulugu tarafindan kullanilmaktadir. APT operasyonlari da dahil olmak uzere cok sayida farkli tehdit aktoru kullanmaktadir.

Fähigkeiten & Verhalten

Uzaktan Erişim & Kontrol
Keylogger
Ekran Görüntüsü
Webcam Erişimi
Dosya Yönetimi
Süreç Yönetimi
Komut Yürütme
Kalıcılık Mekanizması

IOC-Liste (20 Indikatoren)

IOC — AsyncRAT
# IP 5.2.3.5 # IP 1.2.3.4 # IP 5.5.8.2 # IP 4.0.0.0 # IP 1.3.6.1 # IP 5.5.7.3 # IP 158.69.36.15 # IP 194.5.212.124 # IP 1.3.14.3 # IP 2.5.29.37 # DOMAIN github.com # DOMAIN module-compiler.cc # DOMAIN ystem.net # DOMAIN system.net # DOMAIN hirr.com # DOMAIN erry-dibbert16ih.ru # DOMAIN encryptor.cc # DOMAIN githubusercontent.com # DOMAIN m000webhostapp.com # DOMAIN fully.gg
TypWertBemerkung
ip 5.2.3.5 C2 aday
ip 1.2.3.4 C2 aday
ip 5.5.8.2 C2 aday
ip 4.0.0.0 C2 aday
ip 1.3.6.1 C2 aday
ip 5.5.7.3 C2 aday
ip 158.69.36.15 C2 aday
ip 194.5.212.124 C2 aday
ip 1.3.14.3 C2 aday
ip 2.5.29.37 C2 aday
domain github.com C2 domain
domain module-compiler.cc C2 domain
domain ystem.net C2 domain
domain system.net C2 domain
domain hirr.com C2 domain
domain erry-dibbert16ih.ru C2 domain
domain encryptor.cc C2 domain
domain githubusercontent.com C2 domain
domain m000webhostapp.com C2 domain
domain fully.gg C2 domain

C2-Server (8 erfasste Server für diese Familie)

Adresse Typ Port Protokoll Status Land
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —

C2-Adressen stammen ausschließlich aus vom KEYDAL-Team manuell verifizierten Malware-Samples. Kommerzielle Nutzung ist untersagt.

Tags
AsyncRATmalwarestatik-analizIOC