Extracted

• • Target
    86689a4c43d95eb9e2cddb155fd291d8_JaffaCakes118
  • Size 182KB
  • SHA256 89ad189c320fbc12632e1a0eea49223c56c9ccfec6b683a03ce7c0173123f18e
  • MD5 86689a4c43d95eb9e2cddb155fd291d8
  • SHA1 8fb2c3d9f2192e0509ea41747b9f55064c585cd4
  • SHA512 0a2c5190f3fdd32af0a21480fc57711aa04a40d1647486611b5d42ceed7fa315b6ce21443e17604532e50a299ba5c7f9ec5b96203ff40cee9de28fdd7be9ba5d
  • SSDEEP 3072:d5LnIBmuKCjnC6BK5CCe6ryo47iq2xe555UhuhTxyZ9AbeprBIpVTD3cHedzzlda:y7555/4zAaEpV3s6tdmX
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  credential_accessspywarestealer

  • Drops startup file

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2