Extracted

• • Target

    JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8

  • Size

    156KB

  • MD5

    dbf61f566a642cdd0df3fc1d078debb8

  • SHA1

    0294ef20386693a5699bc4e57653f966f0eaf028

  • SHA256

    aead3b29e4eb3a2c5499b67eb81a609bd85944a1d7ec6b9557be527a0c566929

  • SHA512

    4de09065e244d791d8c909a1c6cd689063f8318af2648498f9cf435be19b666aba096f1b2946a75200cacee5a63d705fb545c42a9d6f7a5dbf49d3cd0865467c

  • SSDEEP

    3072:bqOQcs8pmp5W4J44tDlsAU/UwtRUsUUc2fjRs+DVs+A1+HX5wsOZ4T3EMXckbNGV:bqLl2V7H6sA4bEMXc4VLvTGc

  Score

  10^/10

  asyncratdefaultdiscoveryratrezer0

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • ReZer0 packer

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral10behavioral2behavioral3behavioral4behavioral5behavioral6behavioral7behavioral8behavioral9