Extracted

• • Target

    ed43af7b193ed81c6e26a32b94e85059_JaffaCakes118

  • Size

    207KB

  • MD5

    ed43af7b193ed81c6e26a32b94e85059

  • SHA1

    8967043155e61090caa4f1ba6b52395c1da08f17

  • SHA256

    10887d73d64c6dddaf82a238733c5b6846b596bc74038a16b963c5c08e9136bd

  • SHA512

    251902a4332ef45676a11d0c8563b0752405075a6eab2239f818aa9a8db1bbd691cfe48d3d9cd6daf44c8c0a11b60deb52aff856328e00299f89d7b938523584

  • SSDEEP

    3072:DG6kSNbTtLW5D8+vIyNsHNwWSSqS7fp8ECaPKbIwzq+aFdLO388SxOjbUj6wSzOZ:xNbTtLW5Dp2HNwKY+Kb6gUtvIU

  Score

  10^/10

  credential_accesspersistencespywarestealer

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2