Extracted

• • Target

    JaffaCakes118_23c6f72ac16439f390678e968ac5167c

  • Size

    885KB

  • MD5

    23c6f72ac16439f390678e968ac5167c

  • SHA1

    80f6b5e2745ed825c91f6f621d8e3938dda1ed21

  • SHA256

    1fa723612815adefbb73d373505eb0e77074b99daa72e3bdd00493f8468100bb

  • SHA512

    80156d8db04299c779744c89997a6e10d582c93ecdf851a0aad9d55d056e3dc70eaad9a20d88303444abe99da9a792c9bb179cea96c9f426f9f57d7a71422af1

  • SSDEEP

    24576:sc7SuydrlH5xAphuo2QJyOuY0h/8MuXx8is:szu+ZH5Wpt2QJyTn8jXmp

  Score

  10^/10

  asyncratdefaultdefense_evasiondiscoverypersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Modifies WinLogon for persistence

    persistence

  • System Binary Proxy Execution: InstallUtil

    Abuse InstallUtil to proxy execution of malicious code.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2