id: asyncrat-c2

info:
  name: AsyncRAT C2 - Detect
  author: johnk3r
  severity: info
  description: |
    AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victim’s computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.
  reference: |
    https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
  metadata:
    max-request: 1
    verified: "true"
    shodan-query: ssl:"AsyncRAT Server"
    censys-query: services.tls.certificates.leaf_data.issuer.common_name:AsyncRat
  tags: c2,ir,osint,malware

ssl:
  - address: "{{Host}}:{{Port}}"

    matchers:
      - type: word
        part: issuer_cn
        words:
          - "AsyncRAT Server"

    extractors:
      - type: json
        json:
          - " .issuer_cn"