Overview

overview

10

Static

static

3

a504f9dfe6...18.exe

windows7-x64

10

a504f9dfe6...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a504f9dfe6a3554120c7902c56ddf3b2_JaffaCakes118

  • Size

    426KB

  • Sample

    240818-ct3gaataqn

  • MD5

    a504f9dfe6a3554120c7902c56ddf3b2

  • SHA1

    a89ca17e9c1af4912a55bdf49bc0020a3990b408

  • SHA256

    45ba43813271c0c4d377338c381992cd5b0220b80c00cffc0b284f84cc0aee66

  • SHA512

    7557a1bb0edde11ff8d4c68e9c3e11cde7c677e284afcdbd2359dcc9a88692299aa035098663c995948d07518711ac812f7f689a2a559d30da8afed7ce31a08c

  • SSDEEP

    12288:URifysycqld21fNlRU3LmWTvnGeUITYBK7ENId0fGwVTMsMt:UoypcVFWDGXIEcIAILtT

Score
10/10
asyncratdefaultdiscoveryrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

primo1.hopto.org:7771

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    15

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      a504f9dfe6a3554120c7902c56ddf3b2_JaffaCakes118

    • Size

      426KB

    • MD5

      a504f9dfe6a3554120c7902c56ddf3b2

    • SHA1

      a89ca17e9c1af4912a55bdf49bc0020a3990b408

    • SHA256

      45ba43813271c0c4d377338c381992cd5b0220b80c00cffc0b284f84cc0aee66

    • SHA512

      7557a1bb0edde11ff8d4c68e9c3e11cde7c677e284afcdbd2359dcc9a88692299aa035098663c995948d07518711ac812f7f689a2a559d30da8afed7ce31a08c

    • SSDEEP

      12288:URifysycqld21fNlRU3LmWTvnGeUITYBK7ENId0fGwVTMsMt:UoypcVFWDGXIEcIAILtT

    Score
    10/10
    asyncratdefaultdiscoveryrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks