General

  • Target

    fbaae5aefbf3594f6df80196560b04e9_JaffaCakes118

  • Size

    85KB

  • Sample

    241218-qemdeaznhs

  • MD5

    fbaae5aefbf3594f6df80196560b04e9

  • SHA1

    ea3c33b97c4c6f4ca9a5cba967e3446ae50c940c

  • SHA256

    25e21f55b7fbffe0d90e6845044e3e907964a5c278f29fcd1cf0fff9916a2ac3

  • SHA512

    4b853724bb0d135e8762c4ab92688b05af0feb8c13e1cfd1f77753f1812f2121c9c0d2dd3214f2375323368870ee25296567e6d0a34dc2e9ad5fdb3327e8f6f8

  • SSDEEP

    1536:tIc0PnoAqCxWons8Qfu8PB1uTw94D7E7vmKYp4RPHcCWoMY5c+NlMlgL9SW1Ldub:tIAAAonanPKMoSv036c7gL9SW1Lduore

Malware Config

Extracted

Family

asyncrat

Version

Golden Eye 4.8.1

Botnet

Default

C2

23.105.131.217:83

Mutex

Golden-EyeMutex_Golden RAT

Attributes
  • delay

    1

  • install

    false

  • install_file

    SLIP.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      fbaae5aefbf3594f6df80196560b04e9_JaffaCakes118

    • Size

      85KB

    • MD5

      fbaae5aefbf3594f6df80196560b04e9

    • SHA1

      ea3c33b97c4c6f4ca9a5cba967e3446ae50c940c

    • SHA256

      25e21f55b7fbffe0d90e6845044e3e907964a5c278f29fcd1cf0fff9916a2ac3

    • SHA512

      4b853724bb0d135e8762c4ab92688b05af0feb8c13e1cfd1f77753f1812f2121c9c0d2dd3214f2375323368870ee25296567e6d0a34dc2e9ad5fdb3327e8f6f8

    • SSDEEP

      1536:tIc0PnoAqCxWons8Qfu8PB1uTw94D7E7vmKYp4RPHcCWoMY5c+NlMlgL9SW1Ldub:tIAAAonanPKMoSv036c7gL9SW1Lduore

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks