d29bd0f6a2ef5d71750cc3f3394a0e2a4313263e0819ad64a2ae5f0fc32991cf | Triage

Sharing

General

Target

159616bba74ae9b981062df4e254f1d5_JaffaCakes118
Size

170KB
Sample

240505-c19tyacb6y
MD5

159616bba74ae9b981062df4e254f1d5
SHA1

3c8e2ad3fd1e10146e86b6f26525474d85fe90b9
SHA256

d29bd0f6a2ef5d71750cc3f3394a0e2a4313263e0819ad64a2ae5f0fc32991cf
SHA512

54f95d0cda4a480b52d2a21e74f427c0b46e9651ff33a7bb1580efd4bbdad86ae8cf6efbcebb60a7714cc3fdc1a1f972adb5a09194076646c83bbbb177b669ec
SSDEEP

3072:+5ERKdsNSE8jWf+FnGevgjFA+WzmLpJhJ4RpS:+wB8qonGeoFA0lyp

Score

8^/10

evasion spyware stealer trojan

Malware Config

Targets

- Target
  
  159616bba74ae9b981062df4e254f1d5_JaffaCakes118
- Size
  
  170KB
- MD5
  
  159616bba74ae9b981062df4e254f1d5
- SHA1
  
  3c8e2ad3fd1e10146e86b6f26525474d85fe90b9
- SHA256
  
  d29bd0f6a2ef5d71750cc3f3394a0e2a4313263e0819ad64a2ae5f0fc32991cf
- SHA512
  
  54f95d0cda4a480b52d2a21e74f427c0b46e9651ff33a7bb1580efd4bbdad86ae8cf6efbcebb60a7714cc3fdc1a1f972adb5a09194076646c83bbbb177b669ec
- SSDEEP
  
  3072:+5ERKdsNSE8jWf+FnGevgjFA+WzmLpJhJ4RpS:+wB8qonGeoFA0lyp
Score

8^/10

evasion spyware stealer trojan
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks whether UAC is enabled
  evasion trojan
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionspywarestealertrojan

behavioral2

evasionspywarestealertrojan