Overview

overview

10

Static

static

10

002fad8d60...18.exe

windows7-x64

10

002fad8d60...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    002fad8d60e6af1ed924bc4f9d9c9073_JaffaCakes118

  • Size

    860KB

  • Sample

    240426-g9e35sah24

  • MD5

    002fad8d60e6af1ed924bc4f9d9c9073

  • SHA1

    da540c8463db1cf5a3c1b473a4627aac9e43ac09

  • SHA256

    9799541da2b676a58be06384955f1a8534f8732fe911d4c5485f1ebaf0ff8451

  • SHA512

    38826ff189b35c451289dd7469ce94266694d978134053af9f25776359b0a1ddda6c5d5085a3fb5db0ea93f9767ca6562f228a449817a7afc0f988e18779a551

  • SSDEEP

    24576:XhIZV5g1NbEhhUF54clNf7CokNLQyhFoCR+I:Wo54clMSuNU

Score
10/10
echeloncollectiondiscoveryspywarestealer

Malware Config

Targets

    • Target

      002fad8d60e6af1ed924bc4f9d9c9073_JaffaCakes118

    • Size

      860KB

    • MD5

      002fad8d60e6af1ed924bc4f9d9c9073

    • SHA1

      da540c8463db1cf5a3c1b473a4627aac9e43ac09

    • SHA256

      9799541da2b676a58be06384955f1a8534f8732fe911d4c5485f1ebaf0ff8451

    • SHA512

      38826ff189b35c451289dd7469ce94266694d978134053af9f25776359b0a1ddda6c5d5085a3fb5db0ea93f9767ca6562f228a449817a7afc0f988e18779a551

    • SSDEEP

      24576:XhIZV5g1NbEhhUF54clNf7CokNLQyhFoCR+I:Wo54clMSuNU

    Score
    10/10
    echeloncollectiondiscoveryspywarestealer

    • Detects Echelon Stealer payload

    • Echelon

      Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

      stealerspywareechelon

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks