Analysis
-
max time kernel
145s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
26-11-2024 04:41
General
-
Target
9fdeddd401cce01f15d6c4254a575669_JaffaCakes118.exe
-
Size
294KB
-
MD5
9fdeddd401cce01f15d6c4254a575669
-
SHA1
92546ef28c1d9f0f4e73458a99c895071233a28a
-
SHA256
a504deb4e2d63cd4403d4b52b32e6a7e3f60b27e7252a092211ca01bab930a78
-
SHA512
b33f682da5ce440e028e5cb4e998cadbbca538f29ead35dbab806d7b75aacb3c2cebb255d419551268a26be3ea18221f46ccc85d8baca3cc07afe5a3ba4bf77f
-
SSDEEP
6144:yNj2GhNq2GhNq2GhNrs6SrBVMmzsb+osoJL3bznvT8b6Ngy:Wj2iNq2iNq2iNhkBmn8
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
0.5.7B
Botnet
Default
C2
127.0.0.1:888
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Async RAT payload 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\9fdeddd401cce01f15d6c4254a575669_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9fdeddd401cce01f15d6c4254a575669_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
320KB
-
Filesize
72KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB