Extracted

• • Target
    jaffacakes118__c444228e12898e867b80d513ef8b3727
  • Size 276KB
  • SHA256 3a595eacfd950768b4295730c946af5f71463debcc09c85a23ad49409c47cd28
  • MD5 c444228e12898e867b80d513ef8b3727
  • SHA1 37af3668f28b2b8a9ee2629c8c7bbcd1ef0f258f
  • SHA512 031e412c49ed0e7a4223e74447c4be82217632ba679c95b0d6d36638438255b5cd4387148600d5dbbac54409cd58ec75394dc8a11c467f902918eaba2a431e0a
  • SSDEEP 6144:4L3ucenuT8Zgu4xQ9YI4BWMTuzPG8YKQRP/Fmn2dEwg7uEe7:fcenuT8KXxC4BruCtB/4Cwap
  • TLSH
    T1E05402E1C5719A9AE3FC03F9A8CBA63CF3A244237642B9257E91C2F575127313273658
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarebackdoorcredential_accessdiscoverycycbotponypersistenceratspywarestealerupx

  • Detects Cycbot payload

    Cycbot is a backdoor and trojan written in C++.

  • Family: Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot

  • Family: Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2