Extracted

• • Target

    c1f266588c8062a8298e45e60e5bf565_JaffaCakes118

  • Size

    6.5MB

  • MD5

    c1f266588c8062a8298e45e60e5bf565

  • SHA1

    afd49cc707d6cd328e29fccceda275e99c73245a

  • SHA256

    26be141d5d5d25cb277e5be51f1ab728c41d987484ecb8b2555fc85d242e84e2

  • SHA512

    7808379337ea5159df728b61fd101d15c14f67fbc31f6434afcb45adc39336f175837f16e4dc8c1cc5394e9e3cb5fda813271298549d15363d36a516a416b224

  • SSDEEP

    98304:WPdx/6o/EJ6N6ExIxrnumYq429EoQW4Bf1ayqn1wD//mUuAY+V5oFqojeOdJ9OXH:WL6ocnT7pV4BDqM/ONA3zU6OhOX/+I

  Score

  10^/10

  babadedacryptbotcrypterloaderspywarestealerdiscovery

  • Babadeda

    Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.

    loadercrypterbabadeda

  • Babadeda Crypter

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Blocklisted process makes network request

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2