Extracted

• • Target
    jaffacakes118_Trojan.Win32.VBKryjetor.baty.70e12e745fbfe08a6fcbe155a2d1086c
  • Size 786KB
  • SHA256 3cc0673a2dae097af0596df41724f6770be2e444bd9d98bb83b454075c4c8150
  • MD5 70e12e745fbfe08a6fcbe155a2d1086c
  • SHA1 c53ecf7a3648d560310b2a6dbe4947e9b94bfa04
  • SHA512 67d43649ab166c0bb21f1ec4893358651e0815866032d8dfe588155da10395886cdb6ede90d8e7ee214f2540665aae959e33c1e78897718cef72e27500af4fb6
  • SSDEEP 24576:6KxgUaf7sUMOCey0ZSpoujKwnrPuPpzjzCqfjzF:6aaTsFJsSJjKRxPuq7x
  • TLSH
    T14505F123746ACC97DC1481344A96F55C32FDAE033C59FAD261427FAD3B72BA264F484A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoverydownloaderguloaderhawkeyekeyloggerspywarestealertrojan

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2