Extracted

Extracted

• • Target

    c515a556d7cc1fb7a476fb0fb1aadaaa_JaffaCakes118

  • Size

    705KB

  • MD5

    c515a556d7cc1fb7a476fb0fb1aadaaa

  • SHA1

    c5690d2abee36e06c2c40dceba693bc7eeeda7be

  • SHA256

    4ba67a000526a4abcf098ab1671fae28996f0db56a67bdeb36d2ef653e34c35b

  • SHA512

    ceb6047816345ad1767698982d448d48accc1e9b22f0fb7ca9c9233444523531b9ef672041dc73ce6a6b6f22fd7263ca882d6fb19288d0dd726cb7c0eb94a1a2

  • SSDEEP

    12288:0J0unggMGIwHJo8spfSPFWHw2Y8ZKk8mZfurZB+n3mfYBkU4f5YNmmh8o:luoG9priSPFWHw2Y8ZK5d22fYBkU4f5q

  Score

  10^/10

  hawkeyenetwirebotnetcollectiondiscoverykeyloggerpersistenceratspywarestealertrojanupx

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1