Extracted

• • Target

    8f643f69a07dfb10835624ae616afaf6_JaffaCakes118

  • Size

    10.1MB

  • MD5

    8f643f69a07dfb10835624ae616afaf6

  • SHA1

    0524eb639b292a19ee03d8f14894c6a0d9b510c1

  • SHA256

    9d1639d4dbe977d24acbe7736082be04af38e1493174a250815efc1d7b761135

  • SHA512

    3c351fe880df9fbc94c6b4fb0672c11c829227296975bfc23b7b73cab2b7f157342fe16c1345cfd506e3bd21f98e55f2a73410126c032dd80e3ddc3a334673d3

  • SSDEEP

    49152:f41T4ZS/yTAismxs008Kwm7lXRUf4AqlN/9akfz4NaWNODeDDfxvrWjEmG4/0oKb:f4p4ZS/y1

  Score

  10^/10

  adwindlokibotxtremeratcollectionevasionpersistenceratspywarestealertrojanupxdiscovery

  • AdWind

    A Java-based RAT family operated as malware-as-a-service.

    trojanadwind

  • Class file contains resources related to AdWind

  • Detect XtremeRAT payload

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • UAC bypass

    evasiontrojan

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Disables Task Manager via registry modification

    evasion

  • Disables use of System Restore points

    evasion

  • Modifies Installed Components in the registry

    persistence

  • Sets file execution options in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2