Extracted

• • Target

    4a12be812cd0675296bd5846528b5dac_JaffaCakes118

  • Size

    3.7MB

  • MD5

    4a12be812cd0675296bd5846528b5dac

  • SHA1

    e1609ddc6315ec0f28b088ff0cd7fd21faa83834

  • SHA256

    96bd83c30943e45b4bfd457aecccbc05f041f897da86340d5be89280d50c486e

  • SHA512

    1f5f51f3522daab1feae6f8e97a58dfb41463ca03bbba689c2ce1569a04ac9d6445cd9624792d263484f8aa5077b22ae6899a2cdd36cdcb7d5e016b7b607cf66

  • SSDEEP

    24576:lAHnh+eWsN3skA4RV1Hom2KXMmHa0ifaOza5Gmuk0eJSKTXyxcdgdfQCdaQ6+RRE:Uh+ZkldoPK8Ya055

  Score

  10^/10

  xtremeratpersistenceratspywareisrstealercollectionstealertrojanupx

  • Detect XtremeRAT payload

  • ISR Stealer

    ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

    trojanstealerisrstealer

  • ISR Stealer payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2