Extracted

• • Target

    e56e1ee0af12a066ee5004ea327c53ee_JaffaCakes118

  • Size

    5.7MB

  • MD5

    e56e1ee0af12a066ee5004ea327c53ee

  • SHA1

    50aaf0098ec7ae18a964711ee3ecc4b20da208da

  • SHA256

    40f450c93ce882fc29eabef25e8c13a7c3c8243de54c34d6a3bbc75aae69977b

  • SHA512

    92a03ba03ea3ae0903fd3e314bc6fa7c0d148a4849ac2f33792dfe9053068f21059fef9f37983a8adc31626eaf2a9e0d2d8fc8c52a885aed6b615c4a56f38f1f

  • SSDEEP

    98304:g6gfOH6jJmAyj1GT1umqYsBR8p3t7PQNsPRZhXk1u:GjJmNjcT1y9Ep3RPksZZhXR

  Score

  10^/10

  44caliberspywarestealer

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber

  • Nirsoft

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2