Overview

overview

9

Static

static

7

f83a20f718...18.exe

windows7-x64

9

f83a20f718...18.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f83a20f718d2b719452e9554e7bfd047_JaffaCakes118

  • Size

    4.2MB

  • Sample

    240418-r6lrmaga97

  • MD5

    f83a20f718d2b719452e9554e7bfd047

  • SHA1

    2980fb923fe8609924194a6eacd701b7f9bcb373

  • SHA256

    a6d2459e454472e4005e2ef23b943d90ab64e46ab0ca6e1735617059c60bfe00

  • SHA512

    2ea6802430ff3c0de84556ad43e9f6a9062b9c9bd254e75efa1a547fb56807e0333a5fec7892d884206045c9db9880cd9df91ead4be373157ef153d03cd80745

  • SSDEEP

    98304:/7zvc7Vd6JvVzBPeZH7V2dp03aGOSic+uDbysEhWNR+Yi9xOnBN9xrAHEn16zoCR:/7w7EreSNSPyAnBN9xl16zoCHOo

Score
9/10
collectionpersistencespywarestealerupx

Malware Config

Targets

    • Target

      f83a20f718d2b719452e9554e7bfd047_JaffaCakes118

    • Size

      4.2MB

    • MD5

      f83a20f718d2b719452e9554e7bfd047

    • SHA1

      2980fb923fe8609924194a6eacd701b7f9bcb373

    • SHA256

      a6d2459e454472e4005e2ef23b943d90ab64e46ab0ca6e1735617059c60bfe00

    • SHA512

      2ea6802430ff3c0de84556ad43e9f6a9062b9c9bd254e75efa1a547fb56807e0333a5fec7892d884206045c9db9880cd9df91ead4be373157ef153d03cd80745

    • SSDEEP

      98304:/7zvc7Vd6JvVzBPeZH7V2dp03aGOSic+uDbysEhWNR+Yi9xOnBN9xrAHEn16zoCR:/7w7EreSNSPyAnBN9xl16zoCHOo

    Score
    9/10
    collectionpersistencespywarestealerupx

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • Nirsoft

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks