AsyncRAT C2 - Detect
ID: asyncrat-c2
Severity: info
Author: johnk3r
Tags: c2,ssl,tls,ir,osint,malware,asyncrat
Description
Section titled “Description”AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victim’s computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.
YAML Source
Section titled “YAML Source”id: asyncrat-c2
info: name: AsyncRAT C2 - Detect author: johnk3r severity: info description: | AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victim’s computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques. reference: | https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat metadata: verified: "true" max-request: 1 shodan-query: ssl:"AsyncRAT Server" censys-query: services.tls.certificates.leaf_data.issuer.common_name:AsyncRat tags: c2,ssl,tls,ir,osint,malware,asyncratssl: - address: "{{Host}}:{{Port}}" matchers: - type: word part: issuer_cn words: - "AsyncRAT Server"
extractors: - type: json json: - " .issuer_cn"# digest: 4a0a004730450220566f28c8a62985b3235121b712b612d97d56e5484200911f9a8cc861b18ccdb6022100bfd6bd6fae000b6ece8c9e0b965da30d7e2ec5e4f08db4d648a9f1e62ea2096b:922c64590222798bb761d5b6d8e72950Guide to check the vulnerabilities
Section titled “Guide to check the vulnerabilities”This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.
$ nuclei -u "URL" -t "ssl/c2/asyncrat-c2.yaml"