Extracted

• • Target

    b0f0683358f3f66718dcdea684a959cc_JaffaCakes118

  • Size

    1.3MB

  • MD5

    b0f0683358f3f66718dcdea684a959cc

  • SHA1

    f59c306fbc3129d09ba4e4ad8321c72a4858209c

  • SHA256

    476dd6c64a2e5c0547956069693b4072929a9a264d05e0d7ade0ba784e22377d

  • SHA512

    4635a3bb6f88fb9c8ece85e13510ecbc8b0f5e955ce234c23a70833c3a93398c96a8847e06c0913dbff01228b3198850b7f530e90095f0e91e2efc7cd8f6b36b

  • SSDEEP

    24576:qQYf/Dlmx2Wm/49ghA0DB1uOXO9Kl6SdOnGGcJvS3KsDcz:n4LUV9kXDBXX2cVdOGG+ucz

  Score

  10^/10

  asyncratevasionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Async RAT payload

    rat

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2