Extracted

• • Target

    567d10dc616a037e225b1a669a2cf7f9_JaffaCakes118

  • Size

    5.6MB

  • MD5

    567d10dc616a037e225b1a669a2cf7f9

  • SHA1

    5341202e2572b57293fdb1ba328f2656e5ee4da2

  • SHA256

    95b27d71fe29def39d849d337649ef73d189262a10f9e35dca407176c98bdc2f

  • SHA512

    25e541fcc518c408ac5f453fc8ede349d186cd984cc8b8ad774a29fbd874ce15eb6c65d164371d55ae5f9265bde73cb3cd8eea067a52ecb9b09b49a6cf744b4a

  • SSDEEP

    98304:5XdiSRAXXY2Ru8/fFxRtJSr9lXzPKk1/73esGItrROT4u27Mr3XQ7FsQvsw0R:5tiSRCXY2H/fFxRzojb1/rGIIXQ7SN

  Score

  10^/10

  44caliberspywarestealervmprotect

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2