General

  • Target

    JaffaCakes118_a8e591ecd1aafcfa6e1a870be72987776f6fbce07e9e32d2a49a86b15d737b56

  • Size

    119KB

  • Sample

    241225-vz2faazncw

  • MD5

    a93b0ec43734f077d5d853fc60501180

  • SHA1

    2941fe0a75d42197faa8187bd349ef00a2f1fe11

  • SHA256

    a8e591ecd1aafcfa6e1a870be72987776f6fbce07e9e32d2a49a86b15d737b56

  • SHA512

    1ee7d11d6ea065ac944d9bd291d4398e04b5b36aacacbf890ad90323fcb753b650b95055744e7a6a06cd3c0a5be1634a259a536cae2b228c068b28961c4be492

  • SSDEEP

    1536:ae9x1r3st/0i/FXT676pe+wqota8YOnOQHuy+P3fkLG8VYk8Qk6fK:/r3stS0Lwqua8YJQd+P3fkdYkBK

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

daveblack.publicvm.com:3861

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      JaffaCakes118_a8e591ecd1aafcfa6e1a870be72987776f6fbce07e9e32d2a49a86b15d737b56

    • Size

      119KB

    • MD5

      a93b0ec43734f077d5d853fc60501180

    • SHA1

      2941fe0a75d42197faa8187bd349ef00a2f1fe11

    • SHA256

      a8e591ecd1aafcfa6e1a870be72987776f6fbce07e9e32d2a49a86b15d737b56

    • SHA512

      1ee7d11d6ea065ac944d9bd291d4398e04b5b36aacacbf890ad90323fcb753b650b95055744e7a6a06cd3c0a5be1634a259a536cae2b228c068b28961c4be492

    • SSDEEP

      1536:ae9x1r3st/0i/FXT676pe+wqota8YOnOQHuy+P3fkLG8VYk8Qk6fK:/r3stS0Lwqua8YJQd+P3fkdYkBK

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks