Extracted

• • Target

    JaffaCakes118_a2e9d4a9c0f5362df3e29f09abf9537d

  • Size

    1.2MB

  • MD5

    a2e9d4a9c0f5362df3e29f09abf9537d

  • SHA1

    420cf46ad7657fc081b6587ee5b0d17087f8bcb6

  • SHA256

    f66073bda48ba8ac6e34f45e7550676f2919aa9bee611561ca6f19a8cfb49b72

  • SHA512

    f6d12c4839af655c35522f8832ea00d1f561bc89ce2414d1106708a0f36dedd2f3711e1c3175aaf4c4427e9c38378f373e9f8d2c8b94d3673946c2f0591a4d8f

  • SSDEEP

    24576:gFtCQinvekY81UmRAOO0+B+i/rOjX25RxQps2ARjTjMpXCYmJy:Wv5mRfO9bzOjX21QJA9H6CYH

  Score

  10^/10

  44caliberdiscoveryspywarestealer

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber

  • 44Caliber family

    44caliber

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2