General
-
Target
JaffaCakes118_fe3fdea48cbe7fe295466792e770838e7b5527d096de3cc1b55ddf21a29c590f
-
Size
72KB
-
Sample
241221-zpyc4azlbn
-
MD5
1be11ef383e4754e590419da2ef3d3c7
-
SHA1
429b75c6806eab425318a05365f95f545a846397
-
SHA256
fe3fdea48cbe7fe295466792e770838e7b5527d096de3cc1b55ddf21a29c590f
-
SHA512
be836d96321930f2bffea0f7e3d7d2f692c8716838a6edb3b523dee006da4a766bb9df25dd9f58d8af54701b0ec2243cb8c2ea89bbacb66fedcc4caca7eae529
-
SSDEEP
1536:EoD1Mth9MRwaeb4hSFqmOoy8grJKmVcl:EoD1MthMwaeb4G4ocNK8Y
Behavioral task
behavioral1
Sample
JaffaCakes118_fe3fdea48cbe7fe295466792e770838e7b5527d096de3cc1b55ddf21a29c590f.exe
Resource
win7-20240903-en
Malware Config
Extracted
asyncrat
0.5.6D
Default
milla.publicvm.com:6606
milla.publicvm.com:7707
milla.publicvm.com:8808
sdjacffkienmtfsm
-
delay
9
-
install
true
-
install_file
firfafox.exe
-
install_folder
%AppData%
Targets
-
-
Target
JaffaCakes118_fe3fdea48cbe7fe295466792e770838e7b5527d096de3cc1b55ddf21a29c590f
-
Size
72KB
-
MD5
1be11ef383e4754e590419da2ef3d3c7
-
SHA1
429b75c6806eab425318a05365f95f545a846397
-
SHA256
fe3fdea48cbe7fe295466792e770838e7b5527d096de3cc1b55ddf21a29c590f
-
SHA512
be836d96321930f2bffea0f7e3d7d2f692c8716838a6edb3b523dee006da4a766bb9df25dd9f58d8af54701b0ec2243cb8c2ea89bbacb66fedcc4caca7eae529
-
SSDEEP
1536:EoD1Mth9MRwaeb4hSFqmOoy8grJKmVcl:EoD1MthMwaeb4G4ocNK8Y
-
Asyncrat family
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-