Extracted

• • Target

    b0bcf19827ffbdf58347f12878707bff_JaffaCakes118

  • Size

    342KB

  • MD5

    b0bcf19827ffbdf58347f12878707bff

  • SHA1

    1113438386f4d9049e6678bd176fd6c7119658f3

  • SHA256

    b5c72c6e9e8d3477dbd97fee514348dc61cc9aad832d33dacb52f1fc86c48768

  • SHA512

    c53c1489f62f6ecd11ea66318760da618fdb4d6c972dbc98347e35de30885955c36a031d6ddf0c6e39de6567c85f65b46299bbee30a81bae0810396bd80e88ec

  • SSDEEP

    6144:J/x73bXTzTvxGz6bnIKoYVCxeVnDYPrcDhMrCPaiUjasX:9v+YVCc+aMuRsX

  Score

  10^/10

  credential_accessevasionpersistencespywarestealer

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Deletes itself

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  behavioral1behavioral2