AsyncRAT — 5f28fc0de30c2301ae8d82e8420df587a5bca6451bbaea053aa2ef48217b2081.exe [5f28fc0d]

Manuel Statik Analiz — AsyncRAT | Tehdit: 高 | CVSS: 7.5

文件 Kimliği

SHA256	`5f28fc0de30c2301ae8d82e8420df587a5bca6451bbaea053aa2ef48217b2081`
MD5	`a99bb6e07b5f1b469ecd1a75f16f8a40`
文件名	5f28fc0de30c2301ae8d82e8420df587a5bca6451bbaea053aa2ef48217b2081.exe
大小	19,790,163 byte (19326 KB)
类型	PE32 executable for MS Windows 6.01 (GUI), Intel i386, 11 sections
String Sayısı	29,038

PE Bölümleri

Bölüm	V.Size	Entropi
`.text`	715,044	6.39
`.itext`	6,324	6.01
`.data`	16,188	5.18
`.bss`	29,516	0.0
`.idata`	4,200	4.82
`.didata`	420	2.57
`.edata`	113	1.34
`.tls`	24	0.0
`.rdata`	93	1.37
`.reloc`	71,052	6.72
`.rsrc`	189,824	1.93

Import Tablosu

kernel32.dll
GetACP
GetExitCodeProcess
CloseHandle
LocalFree
SizeofResource
comctl32.dll
InitCommonControls
user32.dll
CreateWindowExW
TranslateMessage
CharLowerBuffW
CallWindowProcW
CharUpperW
oleaut32.dll
SafeArrayPutElement
VariantInit
VariantClear
SysFreeString
SafeArrayAccessData

IOC

SHA256	`5f28fc0de30c2301ae8d82e8420df587a5bca6451bbaea053aa2ef48217b2081`
MD5	`a99bb6e07b5f1b469ecd1a75f16f8a40`
IP Adresleri	`1.0.0.0`, `7.0.0.3`
Domain	`microsoft.com`
Mutex	`FQueueLock`, `TMonitor.TSpinLock`
C2 Aday	`microsoft.com`

AsyncRAT — 恶意软件档案

AsyncRAT, 2019'da acik kaynak olarak yayimlanan C# tabanli RAT ailesidir. Ekran yakalama, keylogger, dosya islemleri, HVNC ve plugin sistemine sahiptir. C2 AES-128-CBC ile sifrelenir, TCP uzerinden calisir. JS/PDF yemi ile dagitilir.

恶意软件类型

RAT

编程语言

.NET C#

C2协议

TCP/SSL

目标系统

Windows

别名 (AKA)

AsyncClient

技术细节

C# .NET, AES-128-CBC sifreleme, TCP port 6606/4449 (varsayilan), Mutex kontrol, Runtime assembly loading, Anti-analysis (VM check, Process listesi), HVNC, Keylogger, Stealer, Botnet modulu

归因 / 威胁行为者

Acik kaynak - orjinal gelistirici GitHub'da yayinladi; surekli siber suclu toplulugu tarafindan kullanilmaktadir. APT operasyonlari da dahil olmak uzere cok sayida farkli tehdit aktoru kullanmaktadir.

能力与行为

Uzaktan Erişim & Kontrol

Keylogger

Ekran Görüntüsü

Webcam Erişimi

Dosya Yönetimi

Süreç Yönetimi

Komut Yürütme

Kalıcılık Mekanizması

IOC列表 (7 个指标)

IOC — AsyncRAT

# SHA256
5f28fc0de30c2301ae8d82e8420df587a5bca6451bbaea053aa2ef48217b2081

# MD5
a99bb6e07b5f1b469ecd1a75f16f8a40

# IP
1.0.0.0 

# IP
7.0.0.3 

# DOMAIN
microsoft.com 

# MUTEX
FQueueLock 

# MUTEX
TMonitor.TSpinLock

类型	值	备注
sha256	5f28fc0de30c2301ae8d82e8420df587a5bca6451bbaea053aa2ef48217b2081
md5	a99bb6e07b5f1b469ecd1a75f16f8a40
ip	1.0.0.0	C2 aday
ip	7.0.0.3	C2 aday
domain	microsoft.com	C2 domain
mutex	FQueueLock	Mutex
mutex	TMonitor.TSpinLock	Mutex

AsyncRAT — 查看完整档案 →

C2服务器 (该家族共有 8 台已记录服务器)

地址	类型	端口	协议	状态	国家
microsoft.com	domain	—	TCP	active	—
microsoft.com	domain	—	TCP	active	—
microsoft.com	domain	—	TCP	active	—
microsoft.com	domain	—	TCP	active	—
microsoft.com	domain	—	TCP	active	—
microsoft.com	domain	—	TCP	active	—
microsoft.com	domain	—	TCP	active	—
microsoft.com	domain	—	TCP	active	—

C2 地址仅来自 KEYDAL 团队人工验证的恶意软件样本。禁止用于商业用途。

标签

AsyncRATmalwarestatik-analizIOC