Extracted

• • Target

    edea471dc39e7b54e2e3087bc592a131_JaffaCakes118

  • Size

    357KB

  • MD5

    edea471dc39e7b54e2e3087bc592a131

  • SHA1

    0dfbc2355e46a25fdd2a64ec1f6a4666c5c53e12

  • SHA256

    1e1a2a526bdb0bc61703704988fc234cdf7972c3269b3aaeba5dbe435ca6a07b

  • SHA512

    ce1af2439012624d14b208ee4e192fc5d60f97b63e9319e294f98adc5f708a4a3dc8be8737db4de79c2165db101c2fbe1cc7b24efb18b59670d93cf3cf295b57

  • SSDEEP

    6144:DgZO8t72Ixwsf+BLtABPDtFxzerToNZrOGyvRN41V6GIeyX+RA1D0gKiO:a6IxZFfNZrOR7Y69eyXj1DaiO

  Score

  10^/10

  44caliberspywarestealer

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2