Extracted

• • Target

    668a025022e6c8fe47aa0c5e8030e6e0_JaffaCakes118

  • Size

    200KB

  • MD5

    668a025022e6c8fe47aa0c5e8030e6e0

  • SHA1

    04c7630a794b771a9ef1d980b0b2b66998bdc32b

  • SHA256

    a4403195b981f290922312ff5f0464f5fc9719b12dfd38da9639b5cf31ac9846

  • SHA512

    183883d70550a9c333fbb68ddd93c6e7b060978144e693812282da25db6d2d45fad30e05738dbe3e3c96f9565039787aed5ae4fd845afbfea2fa62a5d1e63422

  • SSDEEP

    6144:KSoKfASZZwg+wLoHZdgleUU7v8yav8d45rnhSG:KAASUmLnkJa0d4r

  Score

  10^/10

  spywarestealer

  • Drops file in Drivers directory

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2