Extracted

Extracted

Extracted

• • Target
    ca48a01552acf9cb77202bf0b77a7a1c_JaffaCakes118
  • Size 3.4MB
  • SHA256 106d93ced41d81795f66bb29ad5c847a25a1e2c094fe28a67dc576f1c33fcad4
  • MD5 ca48a01552acf9cb77202bf0b77a7a1c
  • SHA1 1daba5dbab15456462e1ac3e80b782aa867889c2
  • SHA512 f5942e6a162c2b3e5df3ac14b24350f36e393ddb80400fcd47070e70b6eccaa366ef3406c8452b795c7b28cf2266fd8eb1339f51dcc1910a004c72e14cbe8a55
  • SSDEEP 49152:Kj4FOCYYcrX7JGwyTL2RhE3IiSKVFGclOt45MaUEr7NSv2opoSH7QirAnN4tSqJS:cRCHCowyTL2RgSWj5WaU28wN4t0N
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  gcleanerlgoogloaderonlyloggerraccoonvidar87d2a2b472952d29d9ef08f8b28a7b6b1e587f6a933downloaderloaderstealerxmrigminer

  • Detects LgoogLoader payload

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • LgoogLoader

    A downloader capable of dropping and executing other malware families.

    downloaderlgoogloader

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Raccoon Stealer V1 payload

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • OnlyLogger payload

  • Vidar Stealer

    stealer

  • XMRig Miner payload

    miner

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2