0b09c1b778ef42ac2b7c2850418d71c8bc25372273fb8245745ddae5498c493a | Triage

Resubmissions

19/04/2024, 21:57

240419-1vdrbahd51 7

19/04/2024, 18:29

240419-w5drvach4w 7

Sharing

General

Target

fae8d22926ee59a5bad0235fc8a05e8e_JaffaCakes118
Size

6.6MB
Sample

240419-w5drvach4w
MD5

fae8d22926ee59a5bad0235fc8a05e8e
SHA1

b947cc2c2ee4e487e1d704dc7064d6c0063b99f1
SHA256

0b09c1b778ef42ac2b7c2850418d71c8bc25372273fb8245745ddae5498c493a
SHA512

a87724ca92fb7529fc39bd95d69248838506600c6751b6c9be36a8fe042eac761c878b4e18e6d3bba8a60e6a0e271b476c939c7c4b16e564baa77ce56a6caf55
SSDEEP

196608:HyMJPmCsXDjDyf6L2WliXYrHW1L0AFKe7ChS:lPmCEDVL2ciIrHWR7Ke7a

Score

7^/10

pyinstaller spyware stealer

Malware Config

Targets

- Target
  
  fae8d22926ee59a5bad0235fc8a05e8e_JaffaCakes118
- Size
  
  6.6MB
- MD5
  
  fae8d22926ee59a5bad0235fc8a05e8e
- SHA1
  
  b947cc2c2ee4e487e1d704dc7064d6c0063b99f1
- SHA256
  
  0b09c1b778ef42ac2b7c2850418d71c8bc25372273fb8245745ddae5498c493a
- SHA512
  
  a87724ca92fb7529fc39bd95d69248838506600c6751b6c9be36a8fe042eac761c878b4e18e6d3bba8a60e6a0e271b476c939c7c4b16e564baa77ce56a6caf55
- SSDEEP
  
  196608:HyMJPmCsXDjDyf6L2WliXYrHW1L0AFKe7ChS:lPmCEDVL2ciIrHWR7Ke7a
Score

7^/10

spyware stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2