Extracted

Extracted

Extracted

• • Target

    1d14c938c3dc37a1e53ffa556b22d177_JaffaCakes118

  • Size

    1.0MB

  • MD5

    1d14c938c3dc37a1e53ffa556b22d177

  • SHA1

    d212b0d999e33da5994d3966e4bcbb369b1c7289

  • SHA256

    fccc12ba866c71644e8d877c8780ee0ba0178c1712b3c05f957f90f59de6d493

  • SHA512

    816370cd07c7c04fd6a113c2ebb8fa878d7b4df186101e5bd337bc1f931c292d9d72c7cd6c2895c17be612c79d5ab5a56a848407a8072a25f2817f98c1bac176

  • SSDEEP

    12288:K5Ar24e2MaUYo2TVXsdSY7h02P9e1BSPjY7o5B/hlG4sPY0dye3AaQYeFaotTQpv:K5Q7v+7h02Pg+M74HGfIaQ6rei

  Score

  10^/10

  azorultoskiraccoond58ee081e4d259676e5c18189c82f5356e64ec30infostealerspywarestealertrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

    infostealeroski

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Raccoon Stealer V1 payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2