Extracted

Extracted

• • Target

    aa3641a70d4bf48894b9e62420055c83_JaffaCakes118

  • Size

    246KB

  • MD5

    aa3641a70d4bf48894b9e62420055c83

  • SHA1

    b14e467dcde6ef99866cb0835ce2d2df6c1b921f

  • SHA256

    232fea54ac8321f41fa38a31ea3118b7821cb635ebefe1794c6d2e3399d2645a

  • SHA512

    ea372bf621076cbbb628e885428dcaaff2476ddbdebb067c564c9cf567a38bf110d1a4378dd5cdac7935160f2184410ff8e2d2d9f46562c99fbce5232ad186d7

  • SSDEEP

    6144:xxgPhA9k5Ffy9be37tVTfxAj8BjuuPi1hs:xxgvvKOVT5Aj8BjTins

  Score

  10^/10

  strratexecutionpersistencestealertrojanwshratdiscovery

  • STRRAT

    STRRAT is a remote access tool than can steal credentials and log keystrokes.

    trojanstealerstrrat

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2