Statik Analiz — AsyncRAT | ALTO | CVSS: 7.5

Arquivo

SHA2560001b8219a77f8e206efe2b71ecf3892aed755c26fb2dc5e4b7b42a226b72eaa
MD532066ff6369a7bd794f03bdb77c399f3
Arquivo0001b8219a77f8e206efe2b71ecf3892aed755c26fb2dc5e4b7b42a226b72eaa.exe
Tamanho4,486,656 byte
TipoPE32+ executable for MS Windows 6.02 (DLL), x86-64, 7 sections
Stringler15,296

Bölümler

AdEntropi
.text5.7
.rdata5.47
.data6.01
.pdata5.53
.didat4.04
.rsrc5.12
.reloc5.59

IOC

SHA2560001b8219a77f8e206efe2b71ecf3892aed755c26fb2dc5e4b7b42a226b72eaa
MD532066ff6369a7bd794f03bdb77c399f3
IP5.2.3.5, 1.2.3.4, 5.5.8.2, 4.0.0.0, 1.3.6.1, 5.5.7.3, 158.69.36.15, 194.5.212.124
Domaingithub.com, module-compiler.cc, ystem.net, system.net, hirr.com, erry-dibbert16ih.ru, encryptor.cc, githubusercontent.com
C21.2.3.4:5678, github.com, module-compiler.cc, ystem.net, system.net, hirr.com

AsyncRAT — Perfil do malware

AsyncRAT, 2019'da acik kaynak olarak yayimlanan C# tabanli RAT ailesidir. Ekran yakalama, keylogger, dosya islemleri, HVNC ve plugin sistemine sahiptir. C2 AES-128-CBC ile sifrelenir, TCP uzerinden calisir. JS/PDF yemi ile dagitilir.

Tipo de malware
RAT
Linguagem de programação
.NET C#
Protocolo C2
TCP/SSL
Sistemas-alvo
Windows
Também conhecido como (AKA)
AsyncClient

Detalhes técnicos

C# .NET, AES-128-CBC sifreleme, TCP port 6606/4449 (varsayilan), Mutex kontrol, Runtime assembly loading, Anti-analysis (VM check, Process listesi), HVNC, Keylogger, Stealer, Botnet modulu

Atribuição / Ator da ameaça

Acik kaynak - orjinal gelistirici GitHub'da yayinladi; surekli siber suclu toplulugu tarafindan kullanilmaktadir. APT operasyonlari da dahil olmak uzere cok sayida farkli tehdit aktoru kullanmaktadir.

Capacidades e comportamento

Uzaktan Erişim & Kontrol
Keylogger
Ekran Görüntüsü
Webcam Erişimi
Dosya Yönetimi
Süreç Yönetimi
Komut Yürütme
Kalıcılık Mekanizması

Lista IOC (20 indicadores)

IOC — AsyncRAT
# IP 5.2.3.5 # IP 1.2.3.4 # IP 5.5.8.2 # IP 4.0.0.0 # IP 1.3.6.1 # IP 5.5.7.3 # IP 158.69.36.15 # IP 194.5.212.124 # IP 1.3.14.3 # IP 2.5.29.37 # DOMAIN github.com # DOMAIN module-compiler.cc # DOMAIN ystem.net # DOMAIN system.net # DOMAIN hirr.com # DOMAIN erry-dibbert16ih.ru # DOMAIN encryptor.cc # DOMAIN githubusercontent.com # DOMAIN m000webhostapp.com # DOMAIN fully.gg
TipoValorNota
ip 5.2.3.5 C2 aday
ip 1.2.3.4 C2 aday
ip 5.5.8.2 C2 aday
ip 4.0.0.0 C2 aday
ip 1.3.6.1 C2 aday
ip 5.5.7.3 C2 aday
ip 158.69.36.15 C2 aday
ip 194.5.212.124 C2 aday
ip 1.3.14.3 C2 aday
ip 2.5.29.37 C2 aday
domain github.com C2 domain
domain module-compiler.cc C2 domain
domain ystem.net C2 domain
domain system.net C2 domain
domain hirr.com C2 domain
domain erry-dibbert16ih.ru C2 domain
domain encryptor.cc C2 domain
domain githubusercontent.com C2 domain
domain m000webhostapp.com C2 domain
domain fully.gg C2 domain

Servidores C2 (8 servidores registrados para esta família)

Endereço Tipo Porta Protocolo Status País
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —
microsoft.com domain — TCP active —

Os endereços C2 são fornecidos apenas a partir de amostras de malware verificadas manualmente pela equipe KEYDAL. O uso comercial é proibido.

Tags
AsyncRATmalwarestatik-analizIOC