Extracted

• • Target
    jaffacakes118_Camfrog Video Chat Pro 5.5.236 incl. Serial (Multi_Deutsch).exe
  • Size 15.0MB
  • SHA256 686016ba438739235e5098092b821130a152d7b73e1d5395b4099c3fe31c525f
  • MD5 978c333cd9d5fad065487ad8d7a1129b
  • SHA1 30474090d800d0f77df4e199d5f76e0119d2f9cb
  • SHA512 d41299cf0930093d5a4df73a653e02ad9469461531f27d4a498892abffe696f2bb134c8b94e38ca0acf4fb74d39a51e9ef264163f237c5d19cabde352b3e3cf8
  • SSDEEP 6144:guNc3bqsYMhRh7TbI8meOEC111SzaMhb0YNfIEiN:guobqW7RbI8ZO51afht1m
  • TLSH
    T1F0F6022A37F04461F0A2C6304E664B4857B77C2759789A05B7E82D2E9F33A44991AF3F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryisrstealersalitystealertrojanupx

  • Family: ISR Stealer

    ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

    trojanstealerisrstealer

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • ISR Stealer payload

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2