Extracted

• • Target

    3c2df1a6b07c9653d6096d7848987e1f_JaffaCakes118

  • Size

    165KB

  • MD5

    3c2df1a6b07c9653d6096d7848987e1f

  • SHA1

    07992d239c5e69cfe2a6a909140943924f415575

  • SHA256

    63a90c1fb09d01eb9e306f152d129e57d27092c63f0a6b08360d60bcfba9fb8e

  • SHA512

    3addbaade61eed7f3f0d96fa1f888be55f10d180e43ff1e357be7ec3d7b7da175532ecf87a175339d4878dbac86107a5753fb99032bbb4771cd6327696b4dd8e

  • SSDEEP

    3072:lybEQ/OLsU5zSBk6hPWIwb1GOXCAORUwNNFBJfqy:+/OLsvk60GOSTTbj

  Score

  10^/10

  spywarestealer

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2