Extracted

• • Target

    fd2f11c31192e8efe0eb4b37d1a5e1b6_JaffaCakes118

  • Size

    9.5MB

  • MD5

    fd2f11c31192e8efe0eb4b37d1a5e1b6

  • SHA1

    48b2610a347ae04cd61cd33100715ca5476e1951

  • SHA256

    a15c3b6773fa9d8db715f8c557c76c95e8f84db0fa5046ed7a01589bfdc778b5

  • SHA512

    39a5e38dfb04b462e167462e78fe9cf018215cd8e9fcc7e1cf67e6ea93f99176af49995ed9c987899f140fe32faeda6757a2e814944b899454e771f183b04afa

  • SSDEEP

    196608:0FSJAB+ZcpS+S6SrGTsD2dmmhGlkrwPgZS7rjsn6P44Nm:0FS+Bkc0+Fe6dmracMR7

  Score

  10^/10

  44caliberxmrigevasionminerspywarestealerdiscovery

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Stops running service(s)

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2