b8eaca0905fc46ad6f69320954a0ec35fcd571fc829ed264a908c7aaa2b4eb92

Analysis

Target
394-20200707-10-AKPROP.jar
Size 437KB
Sample200708-1trbc1c75n
SHA256 b8eaca0905fc46ad6f69320954a0ec35fcd571fc829ed264a908c7aaa2b4eb92
MD5 3ed6c63f4c06dbeedb1d49f943ee4215
SHA1 6ae2a4d5fa0a62203607dc339ceae9a7eb332abf
SHA512 2af56f592554ab710b1f02b2390e5585be6f9723a79f2161a9323cfe9ea8739bf5d2b227c78570c1249f8fca9f7877674d2a133699709e21c072779a72713f34
MD5 SHA1 SHA512

Score

7^/10

spyware

Loads dropped DLL 2 IoCs

pid	Process
2788	java.exe
2788	java.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	bot.whatismyipaddress.com

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\394-20200707-10-AKPROP.jar
1⤵
- Loads dropped DLL
PID:2788

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact