Extracted

Extracted

Extracted

• • Target

    JaffaCakes118_2354d9753f0f741bd358dae604e48c3e

  • Size

    1012KB

  • MD5

    2354d9753f0f741bd358dae604e48c3e

  • SHA1

    f128c560612c22c30ff0a3593bb66794ae7774d5

  • SHA256

    f3be725453067dd4fd33c93d841f8bc707334cad295708f36319294405066346

  • SHA512

    f5efb5abeaee35770ffb44cedce62bb718553d730eb25ab93b3538deed30ea88c35db5961890ab134f8dd9f8fe3da55b9a48951d07ba39709dcd42dcacf2208b

  • SSDEEP

    12288:hxt6hRd3GUju9Al4QMe89d18EbVAXMJrQF0p4v9TH9yzsN2j33+RgshWtqU59d3i:hxQhf3DcA78DbVAXWQF0p2hNIeQqU5w1

  Score

  10^/10

  azorultoskiraccoonb76017a227a0d879dec7c76613918569d03892fbdiscoveryinfostealerspywarestealertrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Azorult family

    azorult

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

    infostealeroski

  • Oski family

    oski

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Raccoon Stealer V1 payload

  • Raccoon family

    raccoon

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2