Extracted

• • Target

    JaffaCakes118_a2ed7ee4774559afd500659c16674e5f

  • Size

    569KB

  • MD5

    a2ed7ee4774559afd500659c16674e5f

  • SHA1

    b0413ea8b0116c205d051ca60ada2c03cfd99799

  • SHA256

    8700911ee526af2051c9485f71804da170c9f76ba50ec266598169159a654469

  • SHA512

    61782e6854f993779d82dd281570cee9b4d62dd4351b4fcb55695b49f34df57d769729cae97822ba070f4cd95d1c1c1452aa34fc8cecc0897d114d0afb7b3864

  • SSDEEP

    12288:f20IpfjSt64LnnhlgVRZ7K/Tk7SP0q6qKLnHEbpt26XE85RSKoT:fPemtrLnY7ETMi07ZC

  Score

  10^/10

  discoveryevasionexecutionasyncratdefaultrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2