Extracted

• • Target

    ea7a606cace4fb3e16c1664c8acabc9e_JaffaCakes118

  • Size

    441KB

  • MD5

    ea7a606cace4fb3e16c1664c8acabc9e

  • SHA1

    3f53b10103b16228e4449ef74b98d5e139eb0ad9

  • SHA256

    eed1f52569e1839586f5d70b09ce36873b081b0ce70f47b7bccf16a17edd561c

  • SHA512

    f04c608c1a9552d67724dc4da0d94f147655d4bf5267367b2b69c751bf58226047af3cc93ca489df04211d5e545c74c6aa802720c9c559c3038443e1d7e4c015

  • SSDEEP

    6144:3WwCl8PaBsyV6p0yN90QEQ/0qY76bl3joLpx3Iw5RHHwahL/n6X:3MnBsyy90G0qY74cdx3IYNBP6

  Score

  10^/10

  credential_accessdiscoverypersistencespywarestealerupx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2