Overview

overview

10

Static

static

10

2a2cb30aad...18.exe

windows7-x64

10

2a2cb30aad...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2a2cb30aad7f963c02e030616945fcd0_JaffaCakes118

  • Size

    45KB

  • MD5

    2a2cb30aad7f963c02e030616945fcd0

  • SHA1

    3990931750e1415ad539fbb4c31c31f45847aba6

  • SHA256

    a06b140ab8f1665d9dbacaa20da469622ce010c01a7fcef3b69121440bc3019c

  • SHA512

    427237b92f4d56228dfbebb9b6a9a62d3848f2550179199bd3d33dad7c089a0a4c6607bf51224d8d93db971426a4fef3d5e7e2f3a7eff6d3332de074f2146c68

  • SSDEEP

    768:quZPpT1Uu4/cWUeC66mo2q1MDEbHB8+OPI/TzjbXgX3iqSo50LBDZwx:quZPpT1tr2DyR3/T3bwXSqSocdwx

Score
10/10
rataugasyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

AUG

C2

chongmei33.publicvm.com:2703

chongmei33.publicvm.com:49746

chongmei33.publicvm.com:46422

chongmei33.publicvm.com:6578

dongreg202020.duckdns.org:2703

dongreg202020.duckdns.org:49746

dongreg202020.duckdns.org:46422

dongreg202020.duckdns.org:6578

rahim321.duckdns.org:2703

rahim321.duckdns.org:49746

rahim321.duckdns.org:46422

rahim321.duckdns.org:6578

172.94.109.17:2703

172.94.109.17:49746

172.94.109.17:46422

172.94.109.17:6578

chonglee575.duckdns.org:2703

chonglee575.duckdns.org:49746

chonglee575.duckdns.org:46422

chonglee575.duckdns.org:6578
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    true

  • install_file

    svchost.exe

  • install_folder

    %Temp%

aes.plain

Signatures

  • Async RAT payload 1 IoCs
    rat
  • Asyncrat family
    asyncrat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2a2cb30aad7f963c02e030616945fcd0_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections