Extracted

• • Target

    e8545399823b411ea6cb927e80aded0f_JaffaCakes118

  • Size

    493KB

  • MD5

    e8545399823b411ea6cb927e80aded0f

  • SHA1

    22af521e6119003289b6bd5d7be9a3328acb59cc

  • SHA256

    3d31e58a5488a2ec7fb942d3b7005b73b7a617b2b31c89aae7edf6b460edd11e

  • SHA512

    91b5f2c5fda648d4b54e5a434cb8848c3b1a51627387d552d12461adbc4f1925d3a1f23321f36e6404d6d7eff616cd428f648e5b44384f2c394e2777f0b938f6

  • SSDEEP

    6144:WE3WAe1LXFPQbIQrn7xVEcMXBvsEbfKBqwOwD71tJ71Py6QSIRhg0ST7IYzMTFOB:WKWAebYYc4hbmOwD71tJha6QSGdAF7

  Score

  10^/10

  asyncratdefaultagilenetpersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Suspicious use of SetThreadContext

  behavioral1behavioral2