Extracted

Extracted

• • Target
    jaffacakes118_03c624984400f364727f11618a27892495cbea69967b3b11a95f72a08dc14d57.bin
  • Size 4.8MB
  • SHA256 03c624984400f364727f11618a27892495cbea69967b3b11a95f72a08dc14d57
  • MD5 f6f4388a07e6435e3a3d0c979b5c3628
  • SHA1 c7c969d8ecfe016cca792fd284dc585f9b7a13a5
  • SHA512 7dfece4d1d3004aa1b6ba564864016121c592cee1f6122ac5fe326b0492487d4972646072b28dfc46424340415d02545da3357c79390e168faa279478ffebfe1
  • SSDEEP 24576:qiIvfDzKMIjZp1iywkISXFtOldDWOAhHi0DOakStZ51m9eIFqUTWbXODThCP68V6:qicfJg3T7OvNVahiP1DthN
  • TLSH
    T1BF3629BAAD81A9FBF3F6B1BAF3BD2512453139313810A8D60EF232551B7C5A55871C23
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionadwindlokibotxtremeratpersistenceprivilege_escalationratspywarestealertrojanupx

  • Class file contains resources related to AdWind

  • Detect XtremeRAT payload

  • Family: AdWind

    A Java-based RAT family operated as malware-as-a-service.

    trojanadwind

  • Family: Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Family: XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Disables Task Manager via registry modification

    defense_evasion

  • Disables use of System Restore points

    defense_evasion

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2