General

  • Target

    JaffaCakes118_97e7a7c29036a23e9946547b870408ce

  • Size

    617KB

  • Sample

    250108-k8rx4atmc1

  • MD5

    97e7a7c29036a23e9946547b870408ce

  • SHA1

    d6b5691c5a54c0f9045fc0f831a331e046392d20

  • SHA256

    71da2290624e7c3bb9490b64476d73317285f2df352faf649216f1270cff8485

  • SHA512

    24bf2264a7fe8aa7e8b7dadfd44d254032c17e71aeee1361d2444fe37eaf4759b7f3d740e96fa2ed6067884e9a5b57f795a42a2df99e91c26b4a0b4cdb38cc01

  • SSDEEP

    6144:dC4w8juap56y9dg4sIo9ZCf6YRZDYnDSb+Ox72aR914w6Fs2gVKiEgNaratgMf:Ynapvg4sz9dYRZsDy+M70sdpEmar3Mf

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

1

C2

185.157.160.136:1973

Mutex

df4Rtg34dFjwr7ujp3

Attributes
  • delay

    38

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      JaffaCakes118_97e7a7c29036a23e9946547b870408ce

    • Size

      617KB

    • MD5

      97e7a7c29036a23e9946547b870408ce

    • SHA1

      d6b5691c5a54c0f9045fc0f831a331e046392d20

    • SHA256

      71da2290624e7c3bb9490b64476d73317285f2df352faf649216f1270cff8485

    • SHA512

      24bf2264a7fe8aa7e8b7dadfd44d254032c17e71aeee1361d2444fe37eaf4759b7f3d740e96fa2ed6067884e9a5b57f795a42a2df99e91c26b4a0b4cdb38cc01

    • SSDEEP

      6144:dC4w8juap56y9dg4sIo9ZCf6YRZDYnDSb+Ox72aR914w6Fs2gVKiEgNaratgMf:Ynapvg4sz9dYRZsDy+M70sdpEmar3Mf

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks