Extracted

• • Target
    jaffacakes118_f748ed6b36182ce65e916364d340f5121276bd2721116c14b0f9776af97beaec.bin
  • Size 1.2MB
  • SHA256 f748ed6b36182ce65e916364d340f5121276bd2721116c14b0f9776af97beaec
  • MD5 249ebe1c04801518f8a39ed2413a12ad
  • SHA1 a2cc76c01a05196e4fe385ed38f2d259ec6249b1
  • SHA512 a3caa67ba5957230f60dc5e1a6db8b90043716aa61196e9dc3aa2da620ec51a56e3ab12fe94db16da585247f46df5243c5997523bd9c2640df731c27d1c9af39
  • SSDEEP 24576:BJd+Afzi8qpTh2sntUc7y887tTB+zm8YFHcTVRIkhHAO:BBiHTh2O88e+zXYF8pC
  • TLSH
    T18B457D0BA26641BCD4BBE1789A175A47F775704603705AEB07E046AA3F13FE19EBE310
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  collectioncredential_accessdiscoveryexecutionpersistenceprivilege_escalationspywarestealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2