Extracted

• • Target

    JaffaCakes118_8242ac4eb36f38ac6791b45268abed92

  • Size

    1.2MB

  • MD5

    8242ac4eb36f38ac6791b45268abed92

  • SHA1

    12a00ac920b31ebb75f6cf56e768315e96a7bcc6

  • SHA256

    8b984bb6ea6cee5b9c17766a488c8ab0ace05ea355dd07a415c84383746efef9

  • SHA512

    90305f195022afb27653fca0023b29eac5ba72e21000219285ca7168de76133da14a7c2ca6b8c98cb56d62a1826b05505de533e497feeb2295c95a356dbac8d0

  • SSDEEP

    24576:XbDbhxpUABuuc7eLldwcdECl7xpVlMKnKoAjBt6jodgbKmp+rRwjT332P:reAnrcciEpT1KoAjB6od8KmJTn2P

  Score

  10^/10

  44caliberdiscoveryspywarestealer

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber

  • 44Caliber family

    44caliber

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2