Extracted

• • Target
    5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118
  • Size 563KB
  • SHA256 cdd9667696f58e9b9d37f385f41fe88b0fbd84ec26c32ce4df3e3b74d19947d6
  • MD5 5f14fc79c9bce3df9e91f7fa1ebe55ff
  • SHA1 08aa237941fc6567b4684b8bed1ca5dde45b26a6
  • SHA512 f61fd1e92476eb82ee24581f4d1fca10a08481aeac044dc4f5a3ed7d55b0f2282c721fb2f686437f278f555fe9cf42952b3381f5e59ba7a5fb2472f6c70f3c19
  • SSDEEP 12288:EiYco+gunQUBCEAWfykqVNe3U24eoz8LWyN:ENZunQU1aVNe3U24QLWyN
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectiondiscoverypersistencespywarestealerupx

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2