Extracted

• • Target

    5a673359f805a9349b7dbaa686cbc6e4_JaffaCakes118

  • Size

    5.7MB

  • MD5

    5a673359f805a9349b7dbaa686cbc6e4

  • SHA1

    2f31abdd1773521363234eb4d73970dbae46bb75

  • SHA256

    b94fcf4ac17020c3f379131719c6cfa33b8da8f930a455b952ad4ad44f888eb0

  • SHA512

    8aa30743bf3601d8395e07ae900f24f2fc7f016556693f0e71f2238165c29e1a296f8b44893f640d7a5d64b74740e76852e65ee844632167b8b4a4d2b7fd4b39

  • SSDEEP

    98304:GswjbjOhJVHrhIW5xvgEEWhl3UE9h4NWvrrhm8AtrljsPojNwn/5xIp:JdtvEykE9hqWXXUMiOn/2

  Score

  10^/10

  44caliberstormkittydiscoveryspywarestealer

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2