a523e6ea004b8133989f5008cf954f4f9d0e16d8112ded4f68e78e386a2a3911 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fdd338504e2303e04824f08092c4ad50_JaffaCakes118
Size

72KB
Sample

240420-2plemsbh69
MD5

fdd338504e2303e04824f08092c4ad50
SHA1

52cca1e38552325043aa052cd1b91c432db469d2
SHA256

a523e6ea004b8133989f5008cf954f4f9d0e16d8112ded4f68e78e386a2a3911
SHA512

f4da8680c35464fb7538c9c2079c0df9f14b4072e3820eb96c20ea59a5de425920fea50c38f0e11f3022868b013b6e400dba4c29fc3d16104d90ddcd77b47e2c
SSDEEP

1536:p4q8Q1xZtffrb8sjPFNhTYsFFrzckH2fmitLSwEEaadCG:qKtfDwsjPThTYszDH2fxEEjl

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  fdd338504e2303e04824f08092c4ad50_JaffaCakes118
- Size
  
  72KB
- MD5
  
  fdd338504e2303e04824f08092c4ad50
- SHA1
  
  52cca1e38552325043aa052cd1b91c432db469d2
- SHA256
  
  a523e6ea004b8133989f5008cf954f4f9d0e16d8112ded4f68e78e386a2a3911
- SHA512
  
  f4da8680c35464fb7538c9c2079c0df9f14b4072e3820eb96c20ea59a5de425920fea50c38f0e11f3022868b013b6e400dba4c29fc3d16104d90ddcd77b47e2c
- SSDEEP
  
  1536:p4q8Q1xZtffrb8sjPFNhTYsFFrzckH2fmitLSwEEaadCG:qKtfDwsjPThTYszDH2fxEEjl
Score

7^/10

spyware stealer
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2