Overview

overview

10

Static

static

10

f550a997bf...18.exe

windows7-x64

10

f550a997bf...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f550a997bf80ea6b0a1595f3bddfa1a0_JaffaCakes118

  • Size

    347KB

  • Sample

    240417-jqttashc36

  • MD5

    f550a997bf80ea6b0a1595f3bddfa1a0

  • SHA1

    85f9c702d666f4c1c8ff28696f2aaa10bf041e1c

  • SHA256

    c4332b9fb3274f1cf293471d7d343beb4207968e59551cc17b597ff1b4cab00b

  • SHA512

    4a6278d9161378af0a6b7f14645f7a04d1893e4c732c2f4ac128c0e7cb77617d7f32440c8dbaf5e9e53161fecdc7d8176d340a4749e2eaf3a8899aa6bfdc8aca

  • SSDEEP

    6144:4doPG8GTGTe1GbbTUcwss9Xy2R4cPHjCpYL/h0Q2wVT1AchKbfeVZtRqYwRF:jJFgXy2TU1VKZReRF

Score
10/10
44caliberzgratratspywarestealer

Malware Config

Targets

    • Target

      f550a997bf80ea6b0a1595f3bddfa1a0_JaffaCakes118

    • Size

      347KB

    • MD5

      f550a997bf80ea6b0a1595f3bddfa1a0

    • SHA1

      85f9c702d666f4c1c8ff28696f2aaa10bf041e1c

    • SHA256

      c4332b9fb3274f1cf293471d7d343beb4207968e59551cc17b597ff1b4cab00b

    • SHA512

      4a6278d9161378af0a6b7f14645f7a04d1893e4c732c2f4ac128c0e7cb77617d7f32440c8dbaf5e9e53161fecdc7d8176d340a4749e2eaf3a8899aa6bfdc8aca

    • SSDEEP

      6144:4doPG8GTGTe1GbbTUcwss9Xy2R4cPHjCpYL/h0Q2wVT1AchKbfeVZtRqYwRF:jJFgXy2TU1VKZReRF

    Score
    10/10
    44caliberzgratratspywarestealer

    • 44Caliber

      An open source infostealer written in C#.

      stealer44caliber

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks