17a87d55ab7d3b26e79ba970825f88b633ba355447cddb3ef9751b3e83485956 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

20760af326556b7a0b6df9c101e29e9e_JaffaCakes118
Size

256KB
Sample

240329-m9fybsfd8w
MD5

20760af326556b7a0b6df9c101e29e9e
SHA1

101fd4c8b8086ba57ec16324117729745126eb34
SHA256

17a87d55ab7d3b26e79ba970825f88b633ba355447cddb3ef9751b3e83485956
SHA512

1870484bd63c11729069d7b3765f891abcdd8bcadc77cca7e5946699eeeafb4e369dc48ae1dd83d8fe3238a5345de148cac4a4382fc7ca200edee41eb2660c1d
SSDEEP

6144:M5jwH/7aps5hulwH/Fsd8XDwH/7aps5hulwH/:MpuapIS0rzuapIS

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  20760af326556b7a0b6df9c101e29e9e_JaffaCakes118
- Size
  
  256KB
- MD5
  
  20760af326556b7a0b6df9c101e29e9e
- SHA1
  
  101fd4c8b8086ba57ec16324117729745126eb34
- SHA256
  
  17a87d55ab7d3b26e79ba970825f88b633ba355447cddb3ef9751b3e83485956
- SHA512
  
  1870484bd63c11729069d7b3765f891abcdd8bcadc77cca7e5946699eeeafb4e369dc48ae1dd83d8fe3238a5345de148cac4a4382fc7ca200edee41eb2660c1d
- SSDEEP
  
  6144:M5jwH/7aps5hulwH/Fsd8XDwH/7aps5hulwH/:MpuapIS0rzuapIS
Score

7^/10

persistence spyware stealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer