Extracted

Extracted

Extracted

• • Target

    ca48a01552acf9cb77202bf0b77a7a1c_JaffaCakes118

  • Size

    3.4MB

  • MD5

    ca48a01552acf9cb77202bf0b77a7a1c

  • SHA1

    1daba5dbab15456462e1ac3e80b782aa867889c2

  • SHA256

    106d93ced41d81795f66bb29ad5c847a25a1e2c094fe28a67dc576f1c33fcad4

  • SHA512

    f5942e6a162c2b3e5df3ac14b24350f36e393ddb80400fcd47070e70b6eccaa366ef3406c8452b795c7b28cf2266fd8eb1339f51dcc1910a004c72e14cbe8a55

  • SSDEEP

    49152:Kj4FOCYYcrX7JGwyTL2RhE3IiSKVFGclOt45MaUEr7NSv2opoSH7QirAnN4tSqJS:cRCHCowyTL2RgSWj5WaU28wN4t0N

  Score

  10^/10

  gcleanerlgoogloaderonlyloggerraccoonvidar87d2a2b472952d29d9ef08f8b28a7b6b1e587f6a933downloaderloaderstealerxmrigminer

  • Detects LgoogLoader payload

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • LgoogLoader

    A downloader capable of dropping and executing other malware families.

    downloaderlgoogloader

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Raccoon Stealer V1 payload

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • OnlyLogger payload

  • Vidar Stealer

    stealer

  • XMRig Miner payload

    miner

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2