Create asyncrat-c2.yaml

ssl/c2/asyncrat-c2.yaml

@@ -0,0 +1,29 @@
+id: asyncrat-c2
+
+info:
+  name: Detect SSL Certificate AsyncRAT C2
+  author: johnk3r
+  severity: info
+  description: |
+    AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victim’s computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.
+  reference: |
+    https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
+  metadata:
+    max-request: 1
+    verified: "true"
+    shodan-query: ssl:"AsyncRAT Server"
+  tags: c2,ir,osint,malware
+
+ssl:
+  - address: "{{Host}}:{{Port}}"
+
+    matchers:
+      - type: word
+        part: issuer_cn
+        words:
+          - "AsyncRAT Server"
+
+    extractors:
+      - type: json
+        json:
+          - " .issuer_cn"