Extracted

• • Target

    07537a8f7e1a4207eb82c253fe296a8f_JaffaCakes118

  • Size

    5.5MB

  • MD5

    07537a8f7e1a4207eb82c253fe296a8f

  • SHA1

    85d2beb1cd30e8342eabacb82bcdaa9f01018857

  • SHA256

    b30e0fbf03f4bc7481aae8d625a127105c8a601096408f99ed62878a9579425e

  • SHA512

    c29529f41f382b66a77952949795bb0bb48127070db97436cf1efa3538a257a0e562824177665aa570c5d11adf17ab7cc5d66f0c9aca76d8b85d82a8fb7d269a

  • SSDEEP

    98304:XfN28AUgZFJiJaOht/IIn3qWw7spWOpJoCt6XEki7/A5DDyb3dQLBDlhaHkwEA5L:vA7UgZFJiJJ/IIn1YOICtENJ5D2ZoBO7

  Score

  10^/10

  azorultkpotdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • KPOT

    KPOT is an information stealer that steals user data and account credentials.

    trojanstealerkpot

  • KPOT Core Executable

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Registers COM server for autorun

    persistence

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2