Extracted

Extracted

• • Target

    2c701b9904603479c8e01a692383e396_JaffaCakes118

  • Size

    7.0MB

  • MD5

    2c701b9904603479c8e01a692383e396

  • SHA1

    c9662c1ee3ed00ea0f70d12a6e5ecfa50d1d9c77

  • SHA256

    0a05f8788ca28d5f4e2ad838a36f83107326d3021fc5bc9824fe2c47dfd07712

  • SHA512

    60e2e350e44c5676f283842d2af354b55b559c46eb3e1c8236c2abf87654845f7a6727da1aea824395b0d102a643790fb9eed55f729085dfee595aab259cf650

  • SSDEEP

    196608:WHPdZwCsXDjDyf4L2WliXYrHW1LzbpbWg:eP4CEDHL2ciIrHWRzbB

  Score

  10^/10

  asyncratnjratase_2discoverypersistencepyinstallerrattrojanexecution

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Async RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2