Overview

overview

10

Static

static

10

JaffaCakes...8c.exe

windows7-x64

10

JaffaCakes...8c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c

  • Size

    148.7MB

  • MD5

    38036a70b4ed531dadb58f36408871f0

  • SHA1

    7bf2c52e5b861044dce471293247f3926cb7fc8c

  • SHA256

    6e0775e91dc304bdccef41ad8996aeb886c4d8378dc6f7d9a8789b2739777b32

  • SHA512

    d534c5b00157f9bc49e2edf23b952d5bb4a364969027d1079059a4a9bb3753ed3584b7ec601e8ba608f1ee5fd5f20e0f2cc9986d5b1015a18538dd868301b938

  • SSDEEP

    3145728:bJ3y6Y5xCztM7YOY65971/AG5xCztM7YOY65971hJ3ZR66:t3yFzGGkOYCnAGzGGkOYC33m

Score
10/10
pyinstallerstormkittymercurialgrabber

Malware Config

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Mercurialgrabber family
    mercurialgrabber
  • StormKitty payload 1 IoCs
  • Stormkitty family
    stormkitty
  • Detected Nirsoft tools 1 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c
    .exe windows:5 windows x86 arch:x86

    9222d372923baed7aa9dfa28449a94ea


    Headers

    Imports

    Sections

  • File.pyc