Extracted

• • Target

    d6e5818176c47b965f8287f7c8239d19_JaffaCakes118

  • Size

    152KB

  • MD5

    d6e5818176c47b965f8287f7c8239d19

  • SHA1

    c8d6a923c2efae5c7dad3026f2ce7b3f12950d3e

  • SHA256

    e6fffaa62c9104dea538908099a00122da7151b0d614d6f88270df3e091988fb

  • SHA512

    c0d79254254638902674e7f6bbf38e120f86fed99fb031e75bd65ec6a004ec98f3bf76749317b33017a9427f96f38cb45cc52c5554cbfca97f0f303460090fc4

  • SSDEEP

    1536:RG3uieHXmXYiptXxmnQu8M7trSLgd7mRQG5B1pwlizWzbt5:guie3gvpBMnp57teLgd7mv5npwt5

  Score

  10^/10

  credential_accesspersistencespywarestealer

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2