Extracted

Extracted

Extracted

• • Target
    jaffacakes118_43f80f1d8e99c57e7de509b91d9303929e33c9243b63b0b206909d59113101cc.bin
  • Size 3.4MB
  • SHA256 43f80f1d8e99c57e7de509b91d9303929e33c9243b63b0b206909d59113101cc
  • MD5 96107a340175484b2c19bffe14c4bfab
  • SHA1 a3be338bfb7bc4782cd8732df3c5d0a36bc531fb
  • SHA512 861363a2dae8e0ca8b832e896b21661f009c58ee88f63247ab0d920ab3822a9bfe76f36d0fe834e14a61e2fbf3bbb6805f822600b2053f5301b689f6b9afb927
  • SSDEEP 49152:gF6NvMU++nN7qbPCTxFTHnrxsbvcWvM6SYsRJ2k0O3r2GXuQyOb1wS7VNyx:gF6NvjNqbwFfEjv42GXsM1rRNc
  • TLSH
    T111F5F166D28169E6CD6E35FC7D2E466118EAFC20AC5E1782B2951CC81E3F24077163FB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutiondonutloadergcleanerhijackloaderremus_stealerinstallerloaderpersistenceprivilege_escalationstealer

  • Detects DonutLoader

    loader

  • Detects HijackLoader (aka IDAT Loader)

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Uses browser remote debugging

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2