Extracted

• • Target

    de2f31f3883c0e84e6c4e1c2aebde801_JaffaCakes118

  • Size

    553KB

  • MD5

    de2f31f3883c0e84e6c4e1c2aebde801

  • SHA1

    676d34caa52a4dec4829d724c4a1ccd889f91ff3

  • SHA256

    c0def001b11e3cb4334ab13f6d2ada8a259cbc8fb4932324e2aea9a839aa9c29

  • SHA512

    932d7baf385698ae48cdca85291392f4e7a8bc4bbfb6f53eed504fa6292b5ae79d90e61f08cc1b37c2dd75233bb4ba03fa373a90b08c7d29ef42dc598f831d48

  • SSDEEP

    12288:QPxe0gF2s4XmJOHwUqKSCEL/+NV1oYsjogyAWRdTTBnSB6:AY0gUiAQCdEToOY3gtWRdH0B

  Score

  10^/10

  hawkeyelatentbotdiscoveryevasionkeyloggerpersistencespywarestealertrojan

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2