General

  • Target

    JaffaCakes118_1612db4c5d73a7abac6ccf990f115d38

  • Size

    569KB

  • Sample

    250106-h8b6jazndx

  • MD5

    1612db4c5d73a7abac6ccf990f115d38

  • SHA1

    6c1480c1ee68d4eea0df24310bd95871b59e51c7

  • SHA256

    4b4cc5eea7cfceea058932b2a5985f837eb198c0ca69002a7b8b5b7130de204f

  • SHA512

    21fab0609e3925fa6f428fc56fd22ada47a0db5d369f3c80b6357b037d55ae82c3fa562e2367d5f252f3cc55feb62cd1ac7a2e0646940d546b7b602a86049689

  • SSDEEP

    6144:PC4w8juap56y9dg4sIo9ZCf6YRZDYooV3FtlyPG4wYeVKiEgQaratgMl:Knapvg4sz9dYRZsx1tvpEVar3Ml

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

1

C2

185.157.160.136:1973

Mutex

df4Rtg34dFjwr7ujp3

Attributes
  • delay

    38

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      JaffaCakes118_1612db4c5d73a7abac6ccf990f115d38

    • Size

      569KB

    • MD5

      1612db4c5d73a7abac6ccf990f115d38

    • SHA1

      6c1480c1ee68d4eea0df24310bd95871b59e51c7

    • SHA256

      4b4cc5eea7cfceea058932b2a5985f837eb198c0ca69002a7b8b5b7130de204f

    • SHA512

      21fab0609e3925fa6f428fc56fd22ada47a0db5d369f3c80b6357b037d55ae82c3fa562e2367d5f252f3cc55feb62cd1ac7a2e0646940d546b7b602a86049689

    • SSDEEP

      6144:PC4w8juap56y9dg4sIo9ZCf6YRZDYooV3FtlyPG4wYeVKiEgQaratgMl:Knapvg4sz9dYRZsx1tvpEVar3Ml

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks