Statik Analiz — AsyncRAT | HOCH | CVSS: 7.5

Datei

SHA256bebb4bed2e81e35672a57429b17ed84872949b5833479937ec0ca97a30b1609d
MD5db0156d56474b360016cb3331e59adf2
Dateibebb4bed2e81e35672a57429b17ed84872949b5833479937ec0ca97a30b1609d.exe
Größe3,297,792 byte
TypPE32+ executable for MS Windows 6.00 (DLL), x86-64, 6 sections
Stringler11,755

Bölümler

AdEntropi
.text6.47
.rdata6.7
.data3.41
.pdata6.1
.rsrc3.7
.reloc5.46

Import Tablosu

  • ADVAPI32.dll
  • bcrypt.dll
  • KERNEL32.dll
  • ole32.dll
  • USER32.dll
  • api-ms-win-crt-math-l1-1-0.dll
  • api-ms-win-crt-heap-l1-1-0.dll
  • api-ms-win-crt-string-l1-1-0.dll
  • api-ms-win-crt-convert-l1-1-0.dll
  • api-ms-win-crt-stdio-l1-1-0.dll
  • api-ms-win-crt-runtime-l1-1-0.dll

IOC

SHA256bebb4bed2e81e35672a57429b17ed84872949b5833479937ec0ca97a30b1609d
MD5db0156d56474b360016cb3331e59adf2
IP4.2.1.0, 3.5.0.0, 7.3.0.0, 4.0.0.0
Domainsystem.net, github.com
BTC14ArrayTypeMismatchException, 3y5RxmhcStQpSDzm5EGb8i9pwBUEHqN
C2system.net, github.com

AsyncRAT — Malware-Profil

AsyncRAT, 2019'da acik kaynak olarak yayimlanan C# tabanli RAT ailesidir. Ekran yakalama, keylogger, dosya islemleri, HVNC ve plugin sistemine sahiptir. C2 AES-128-CBC ile sifrelenir, TCP uzerinden calisir. JS/PDF yemi ile dagitilir.

Malware-Typ
RAT
Programmiersprache
.NET C#
C2-Protokoll
TCP/SSL
Zielsysteme
Windows
Auch bekannt als (AKA)
AsyncClient

Technische Details

C# .NET, AES-128-CBC sifreleme, TCP port 6606/4449 (varsayilan), Mutex kontrol, Runtime assembly loading, Anti-analysis (VM check, Process listesi), HVNC, Keylogger, Stealer, Botnet modulu

Attribution / Bedrohungsakteur

Acik kaynak - orjinal gelistirici GitHub'da yayinladi; surekli siber suclu toplulugu tarafindan kullanilmaktadir. APT operasyonlari da dahil olmak uzere cok sayida farkli tehdit aktoru kullanmaktadir.

Fähigkeiten & Verhalten

Uzaktan Erişim & Kontrol
Keylogger
Ekran Görüntüsü
Webcam Erişimi
Dosya Yönetimi
Süreç Yönetimi
Komut Yürütme
Kalıcılık Mekanizması

IOC-Liste (8 Indikatoren)

IOC — AsyncRAT
# 14ArrayTypeMismatchException # 3y5RxmhcStQpSDzm5EGb8i9pwBUEHqN # IP 4.2.1.0 # IP 3.5.0.0 # IP 7.3.0.0 # IP 4.0.0.0 # DOMAIN system.net # DOMAIN github.com
TypWertBemerkung
14ArrayTypeMismatchException BTC
3y5RxmhcStQpSDzm5EGb8i9pwBUEHqN BTC
ip 4.2.1.0 C2 aday
ip 3.5.0.0 C2 aday
ip 7.3.0.0 C2 aday
ip 4.0.0.0 C2 aday
domain system.net C2 domain
domain github.com C2 domain

C2-Server (8 erfasste Server für diese Familie)

Adresse Typ Port Protokoll Status Land
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —

C2-Adressen stammen ausschließlich aus vom KEYDAL-Team manuell verifizierten Malware-Samples. Kommerzielle Nutzung ist untersagt.

Tags
AsyncRATmalwarestatik-analizIOC