Extracted

• • Target

    eb045f6f1699993a09871b1b184c78f1_JaffaCakes118

  • Size

    12.9MB

  • MD5

    eb045f6f1699993a09871b1b184c78f1

  • SHA1

    7466f95d1bbcb5aec42de0cd214fc0604fe2e01e

  • SHA256

    3faedcc22bc895edc7233f536334f3279ba5a37981a785161aeab0475ef663d9

  • SHA512

    223bf649bfd7519b9be57d26c6b8dae1153b95eae2afaa479c967e9a23bc94d31444673ce1fde4503c8f7f68761298ef129ef301e8b49984d9df3a3185194ca1

  • SSDEEP

    393216:hJBaDSaO5n2q/aRvO7HGnBeoCurvpkiO8k9f:SIARW7qB1kibkJ

  Score

  10^/10

  44caliberspywarestealervmprotect

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2