408fbc8c1c5998c85cf52cf9e8ca2162d83ccbc3b25361964e8292770480b2dd | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f81b5e9f8deb307b330c8abc6745fe59_JaffaCakes118
Size

414KB
Sample

240418-qw2jnaff6y
MD5

f81b5e9f8deb307b330c8abc6745fe59
SHA1

0634b52706cf269547a070f347accc60425ba067
SHA256

408fbc8c1c5998c85cf52cf9e8ca2162d83ccbc3b25361964e8292770480b2dd
SHA512

e3d71dc4aa2d9a66face33c1fc17f954307d519d3e36b3601ce7a132b9faba0a9b1c33e6b8f83e66cc3e0363bc4c2be06d027e10cb32e07079131eed690adf26
SSDEEP

12288:TAH9dCqXQMM3JyaX2J3NQc8zd5z97pZQkhxS0Y:TAayZJ3uzzdZX+kh0x

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  f81b5e9f8deb307b330c8abc6745fe59_JaffaCakes118
- Size
  
  414KB
- MD5
  
  f81b5e9f8deb307b330c8abc6745fe59
- SHA1
  
  0634b52706cf269547a070f347accc60425ba067
- SHA256
  
  408fbc8c1c5998c85cf52cf9e8ca2162d83ccbc3b25361964e8292770480b2dd
- SHA512
  
  e3d71dc4aa2d9a66face33c1fc17f954307d519d3e36b3601ce7a132b9faba0a9b1c33e6b8f83e66cc3e0363bc4c2be06d027e10cb32e07079131eed690adf26
- SSDEEP
  
  12288:TAH9dCqXQMM3JyaX2J3NQc8zd5z97pZQkhxS0Y:TAayZJ3uzzdZX+kh0x
Score

7^/10

spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2