46ca77c13ede88ed1dc4be9b4cc30c743288533e11b54a6e7139123a19ce8f47 | Triage

Sharing

General

Target

df2e1a5648b130f214e61c251d710188_JaffaCakes118
Size

158KB
Sample

240406-jkr3hsed87
MD5

df2e1a5648b130f214e61c251d710188
SHA1

e3b705fb05cd816d012362798ec5deea57f7a483
SHA256

46ca77c13ede88ed1dc4be9b4cc30c743288533e11b54a6e7139123a19ce8f47
SHA512

dd380774c8c3dc2219b9109e5886382d5919a1b1dc13b8352d4835ee3d90a1c9e445b3360a9c62ed21d88da60e41945eebbed19e49443ea47cbc98dcaba1ce86
SSDEEP

3072:qKtfDwsjPThTYszDH2fHVUcdPuPHfEjETjPNtSweAhPXjSvZmXHlfHYTo:BtfDwsjPThT5zL2dBUPHfAETTNt2Apz0

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  df2e1a5648b130f214e61c251d710188_JaffaCakes118
- Size
  
  158KB
- MD5
  
  df2e1a5648b130f214e61c251d710188
- SHA1
  
  e3b705fb05cd816d012362798ec5deea57f7a483
- SHA256
  
  46ca77c13ede88ed1dc4be9b4cc30c743288533e11b54a6e7139123a19ce8f47
- SHA512
  
  dd380774c8c3dc2219b9109e5886382d5919a1b1dc13b8352d4835ee3d90a1c9e445b3360a9c62ed21d88da60e41945eebbed19e49443ea47cbc98dcaba1ce86
- SSDEEP
  
  3072:qKtfDwsjPThTYszDH2fHVUcdPuPHfEjETjPNtSweAhPXjSvZmXHlfHYTo:BtfDwsjPThT5zL2dBUPHfAETTNt2Apz0
Score

7^/10

spyware stealer
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2