Statik Analiz — AsyncRAT | HOCH | CVSS: 7.5

Datei

SHA25652c7cb1b79652bb317c68fb4173010bbbf937ed09af679802622c5ccfb5e63eb
MD5e579f4f040e7d99ef57611b1df2bdee7
Datei52c7cb1b79652bb317c68fb4173010bbbf937ed09af679802622c5ccfb5e63eb.exe
Größe37,693,352 byte
TypPE32+ executable for MS Windows 6.00 (console), x86-64, 7 sections
Stringler215,730
PDB: C:\Users\runneradmin\AppData\Local\Temp\pkg.24e0b2b2d51e47b9dba34c30\node\out\Release\node.pdb

Bölümler

AdEntropi
.text6.46
.rdata6.21
.data3.86
.pdata6.8
_RDATA2.91
.rsrc6.16
.reloc5.49

Import Tablosu

  • dbghelp.dll
  • WS2_32.dll
  • IPHLPAPI.DLL
  • PSAPI.DLL
  • USERENV.dll
  • ADVAPI32.dll
  • USER32.dll
  • CRYPT32.dll
  • bcrypt.dll
  • KERNEL32.dll
  • WINMM.dll

IOC

SHA25652c7cb1b79652bb317c68fb4173010bbbf937ed09af679802622c5ccfb5e63eb
MD5e579f4f040e7d99ef57611b1df2bdee7
IP8.1.5.1, 1.3.111.2, 15.1.3.4, 127.255.255.255, 1.3.36.3, 1.3.101.110, 1.3.14.3, 1.3.101.113
Domainwhatwg.org, invisible-island.net, github.com, genretrucklooksvalueframe.net, heap-refs.cc, nodejs.org, hooks.cc, sindresorhus.com
BTC1MutatorUnifiedHeapMarkingVisitor, 1MutatorMinorGCMarkingVisitor, 3333333333333333UUUUUUUUUUUUUUUU, 1yg9iXHZqjNB6hQbbCEAwGxCGX6faVsgQt, 1SuppressMicrotaskExecutionScope
MutexGetStdoutMutex, RecursiveMutex, 0RecursiveMutex, 0SharedMutex

AsyncRAT — Malware-Profil

AsyncRAT, 2019'da acik kaynak olarak yayimlanan C# tabanli RAT ailesidir. Ekran yakalama, keylogger, dosya islemleri, HVNC ve plugin sistemine sahiptir. C2 AES-128-CBC ile sifrelenir, TCP uzerinden calisir. JS/PDF yemi ile dagitilir.

Malware-Typ
RAT
Programmiersprache
.NET C#
C2-Protokoll
TCP/SSL
Zielsysteme
Windows
Auch bekannt als (AKA)
AsyncClient

Technische Details

C# .NET, AES-128-CBC sifreleme, TCP port 6606/4449 (varsayilan), Mutex kontrol, Runtime assembly loading, Anti-analysis (VM check, Process listesi), HVNC, Keylogger, Stealer, Botnet modulu

Attribution / Bedrohungsakteur

Acik kaynak - orjinal gelistirici GitHub'da yayinladi; surekli siber suclu toplulugu tarafindan kullanilmaktadir. APT operasyonlari da dahil olmak uzere cok sayida farkli tehdit aktoru kullanmaktadir.

Fähigkeiten & Verhalten

Uzaktan Erişim & Kontrol
Keylogger
Ekran Görüntüsü
Webcam Erişimi
Dosya Yönetimi
Süreç Yönetimi
Komut Yürütme
Kalıcılık Mekanizması

IOC-Liste (31 Indikatoren)

IOC — AsyncRAT
# 1MutatorUnifiedHeapMarkingVisitor # 1MutatorMinorGCMarkingVisitor # 3333333333333333UUUUUUUUUUUUUUUU # 1yg9iXHZqjNB6hQbbCEAwGxCGX6faVsgQt # 1SuppressMicrotaskExecutionScope # IP 8.1.5.1 # IP 1.3.111.2 # IP 15.1.3.4 # IP 127.255.255.255 # IP 1.3.36.3 # IP 1.3.101.110 # IP 1.3.14.3 # IP 1.3.101.113 # IP 1.101.3.4 # IP 2.5.8.3 # DOMAIN whatwg.org # DOMAIN invisible-island.net # DOMAIN github.com # DOMAIN genretrucklooksvalueframe.net # DOMAIN heap-refs.cc # DOMAIN nodejs.org # DOMAIN hooks.cc # DOMAIN sindresorhus.com # DOMAIN thing.org # DOMAIN people.in # MUTEX GetStdoutMutex # MUTEX RecursiveMutex # MUTEX 0RecursiveMutex # MUTEX 0SharedMutex # MUTEX QEAA_NPEAVMutex # FILEPATH C:\Users\runneradmin\AppData\Local\Temp\pkg.24e0b2b2d51e47b9dba34c30\node\out\Release\node.pdb
TypWertBemerkung
1MutatorUnifiedHeapMarkingVisitor BTC
1MutatorMinorGCMarkingVisitor BTC
3333333333333333UUUUUUUUUUUUUUUU BTC
1yg9iXHZqjNB6hQbbCEAwGxCGX6faVsgQt BTC
1SuppressMicrotaskExecutionScope BTC
ip 8.1.5.1 C2 aday
ip 1.3.111.2 C2 aday
ip 15.1.3.4 C2 aday
ip 127.255.255.255 C2 aday
ip 1.3.36.3 C2 aday
ip 1.3.101.110 C2 aday
ip 1.3.14.3 C2 aday
ip 1.3.101.113 C2 aday
ip 1.101.3.4 C2 aday
ip 2.5.8.3 C2 aday
domain whatwg.org C2 domain
domain invisible-island.net C2 domain
domain github.com C2 domain
domain genretrucklooksvalueframe.net C2 domain
domain heap-refs.cc C2 domain
domain nodejs.org C2 domain
domain hooks.cc C2 domain
domain sindresorhus.com C2 domain
domain thing.org C2 domain
domain people.in C2 domain
mutex GetStdoutMutex Mutex
mutex RecursiveMutex Mutex
mutex 0RecursiveMutex Mutex
mutex 0SharedMutex Mutex
mutex QEAA_NPEAVMutex Mutex
filepath C:\Users\runneradmin\AppData\Local\Temp\pkg.24e0b2b2d51e47b9dba34c30\node\out\Release\node.pdb PDB
AsyncRAT — Zum vollständigen Profil →

C2-Server (8 erfasste Server für diese Familie)

Adresse Typ Port Protokoll Status Land
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —

C2-Adressen stammen ausschließlich aus vom KEYDAL-Team manuell verifizierten Malware-Samples. Kommerzielle Nutzung ist untersagt.

Tags
AsyncRATmalwarestatik-analizIOC