Extracted

Extracted

• • Target

    ef523bc52a8f5ba36c4a7f52460c7188_JaffaCakes118

  • Size

    552KB

  • MD5

    ef523bc52a8f5ba36c4a7f52460c7188

  • SHA1

    f83a55fa2457b8f1a4b4d28422fdaff72e48f36d

  • SHA256

    adddb577834025d4220c96acee917ee25df4e7063888ee1bcd7e20ec9905714f

  • SHA512

    ca9735d02ec96698bbd94b97b7df77e7dfc70a335fef88e35834db520c7a6306bbc938067430243057199d7f41af1f7fec99dad4bb47797ed9838c707a00336d

  • SSDEEP

    12288:k9rD+H23OO3n/LpPxM35B9qgObN8F6qlfNUqIFzGRIF6nj1K20XdDixi8B7xDFC6:irDF3ln/Llib0J2

  Score

  10^/10

  collectioncredential_accessdiscoveryspywarestealer

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2