Extracted

• • Target

    3185237a1d3cb270f839f3c025511f15_JaffaCakes118

  • Size

    92KB

  • MD5

    3185237a1d3cb270f839f3c025511f15

  • SHA1

    ba4788c71321d35b7137b6d06d812ff35592406e

  • SHA256

    1d4134e0e6d14d5610f24f914785c4e05d0bc3149e0f1505af97eed0dd9a426b

  • SHA512

    c067e214e75611fd30ee136c576d992d011ae2956099b37b4fcfce7b88993ccb735d3251922df732fe040df531ac592e1003cf126ccb0ba65cd5121e4f7bc54f

  • SSDEEP

    1536:3XqiL7yEuzi2wDOawao+gUGOhQrrL9vnw7rNfEVt7:jPyEuz1YOnSGMQrrL9PwNo7

  Score

  10^/10

  spywarestealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2