Extracted

• • Target

    2ac464aac49537a0c6c023c30c5f2cb1_JaffaCakes118

  • Size

    552KB

  • MD5

    2ac464aac49537a0c6c023c30c5f2cb1

  • SHA1

    5689ec2fb93013842400e37b4d5b05b56084e31d

  • SHA256

    e2f3d9ed24f2318cbda5f3a4a80eb46204e9a191978c9b73971ecfc4b5f5dbe7

  • SHA512

    07bbfcbe64be67125f6b32b8bf5653fd31b129761cc147f0840bd4197470961e4a7e2a3d70f91a28ce1c63845f6d758a9f73adebac5b6bc209326fbefb405359

  • SSDEEP

    6144:Sf/YnyF5SW3tYJaFXcfowRppuyF5SW3tgJaFr7555/4zAaEpV3s6tdm5:SfJ/R3Yeao6ppZ/R30eufEpvu

  Score

  10^/10

  spywarestealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2