Statik Analiz — AsyncRAT | 高 | CVSS: 7.5

文件

SHA25618c781259384f8c799eb03739f7dee9f312c2d9af8f39ea9eda302a43d78af3d
MD5740291019c6a844b4203d870dc26d13f
文件18c781259384f8c799eb03739f7dee9f312c2d9af8f39ea9eda302a43d78af3d.exe
大小6,084,608 byte
类型PE32+ executable for MS Windows 6.00 (DLL), x86-64, 6 sections
Stringler23,152

Bölümler

AdEntropi
.text6.51
.rdata6.84
.data4.35
.pdata6.32
.rsrc3.56
.reloc5.41

Import Tablosu

  • ADVAPI32.dll
  • bcrypt.dll
  • KERNEL32.dll
  • ole32.dll
  • USER32.dll
  • api-ms-win-crt-heap-l1-1-0.dll
  • api-ms-win-crt-math-l1-1-0.dll
  • api-ms-win-crt-string-l1-1-0.dll
  • api-ms-win-crt-convert-l1-1-0.dll
  • api-ms-win-crt-runtime-l1-1-0.dll
  • api-ms-win-crt-stdio-l1-1-0.dll

IOC

SHA25618c781259384f8c799eb03739f7dee9f312c2d9af8f39ea9eda302a43d78af3d
MD5740291019c6a844b4203d870dc26d13f
IP4.2.1.0, 3.5.0.0, 11.11.0.0, 4.0.0.0
Domainsystem.io, github.com, fluentvalidation.net
BTC14ArrayTypeMismatchException, 3E9r3K34Jx8Pes7S4v7qenbkTY8mn813Sw
C2system.io, github.com, fluentvalidation.net

AsyncRAT — 恶意软件档案

AsyncRAT, 2019'da acik kaynak olarak yayimlanan C# tabanli RAT ailesidir. Ekran yakalama, keylogger, dosya islemleri, HVNC ve plugin sistemine sahiptir. C2 AES-128-CBC ile sifrelenir, TCP uzerinden calisir. JS/PDF yemi ile dagitilir.

恶意软件类型
RAT
编程语言
.NET C#
C2协议
TCP/SSL
目标系统
Windows
别名 (AKA)
AsyncClient

技术细节

C# .NET, AES-128-CBC sifreleme, TCP port 6606/4449 (varsayilan), Mutex kontrol, Runtime assembly loading, Anti-analysis (VM check, Process listesi), HVNC, Keylogger, Stealer, Botnet modulu

归因 / 威胁行为者

Acik kaynak - orjinal gelistirici GitHub'da yayinladi; surekli siber suclu toplulugu tarafindan kullanilmaktadir. APT operasyonlari da dahil olmak uzere cok sayida farkli tehdit aktoru kullanmaktadir.

能力与行为

Uzaktan Erişim & Kontrol
Keylogger
Ekran Görüntüsü
Webcam Erişimi
Dosya Yönetimi
Süreç Yönetimi
Komut Yürütme
Kalıcılık Mekanizması

IOC列表 (9 个指标)

IOC — AsyncRAT
# 14ArrayTypeMismatchException # 3E9r3K34Jx8Pes7S4v7qenbkTY8mn813Sw # IP 4.2.1.0 # IP 3.5.0.0 # IP 11.11.0.0 # IP 4.0.0.0 # DOMAIN system.io # DOMAIN github.com # DOMAIN fluentvalidation.net
类型值备注
14ArrayTypeMismatchException BTC
3E9r3K34Jx8Pes7S4v7qenbkTY8mn813Sw BTC
ip 4.2.1.0 C2 aday
ip 3.5.0.0 C2 aday
ip 11.11.0.0 C2 aday
ip 4.0.0.0 C2 aday
domain system.io C2 domain
domain github.com C2 domain
domain fluentvalidation.net C2 domain
AsyncRAT — 查看完整档案 →

C2服务器 (该家族共有 8 台已记录服务器)

地址 类型 端口 协议 状态 国家
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —

C2 地址仅来自 KEYDAL 团队人工验证的恶意软件样本。禁止用于商业用途。

标签
AsyncRATmalwarestatik-analizIOC