Extracted

Extracted

• • Target

    JaffaCakes118_5c2e9058fe49f3581203de4f335fdfd6314f5680692dbccf290d6ef594db9847

  • Size

    7.7MB

  • MD5

    aa2034838226e4fa458cb479330d3df1

  • SHA1

    5d17be875fcb82a808c5314c20a27f221b787c48

  • SHA256

    5c2e9058fe49f3581203de4f335fdfd6314f5680692dbccf290d6ef594db9847

  • SHA512

    01d80e3c1e65881882ca47c7967eb78613aa50de1cb0869545206410d1edab6b15de389f2f4372a3351395692e792a5c7c6cc002db1ce0f12d49da905c998946

  • SSDEEP

    24576:cfn0m/OPb9o/Ha4KZZQLFq487s/0H+VXQ5qDrtj6Bnoi4LD2/Qy4IyQr+KJn04vk:Y

  Score

  10^/10

  evasionexecutiontrojanasyncratdefaultdiscoveryrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • UAC bypass

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2