Extracted

• • Target

    083de2d2dc0be6af200ff93e0e1bf107_JaffaCakes118

  • Size

    379KB

  • MD5

    083de2d2dc0be6af200ff93e0e1bf107

  • SHA1

    43b9c85e1c6e329b4d7427f5f0b13709d7e1c501

  • SHA256

    885a49bf9c395744f269a4c63eb71409e421b65d3aa118375c08fe07bfb90a93

  • SHA512

    21dd6e9e0e5e0c95108c701355248f03cd5fbd01a48e6984f4bb88f1c63c713e01678288f606872bb6299ec5a1fcdeaf0d70ea273d143602d05a6c4d8ae77083

  • SSDEEP

    6144://k/Go3R2v6kElrfFgmosPBMOodZpfxs3PfsIW6HrWc2GVPloHXLt4h:/Muo3R2v6JrFgtUMOgxs346LWCV9o7s

  Score

  10^/10

  discoverypersistencespywarestealerupx

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2