7da764b04ca560c0f609873250e5a4cddd281d1a0d75bffbaf9c376093152269 | Triage

Sharing

General

Target

495570e2206c95b2d86887e902a7af48_JaffaCakes118
Size

9.9MB
Sample

240516-efnr3sah71
MD5

495570e2206c95b2d86887e902a7af48
SHA1

bdb86110afe13bf1167e039eaafad46b0949b2ee
SHA256

7da764b04ca560c0f609873250e5a4cddd281d1a0d75bffbaf9c376093152269
SHA512

c6e5b0ca1f69e818aad606a36b67f2d1c7341d4350a9dcef0d0773c943bb1c781e0a24a1bd809ab0fa4747867350494c58f5ffe223a0edafc311d41faa878e7f
SSDEEP

196608:WBIEoP1HSsimvlG2Ms0tbYPvXJQlHJCsA58Cr3Ox2B6lckvob:WaP1pimt2aJQlpC5dKcxb

Score

7^/10

pyinstaller spyware stealer

Malware Config

Targets

- Target
  
  495570e2206c95b2d86887e902a7af48_JaffaCakes118
- Size
  
  9.9MB
- MD5
  
  495570e2206c95b2d86887e902a7af48
- SHA1
  
  bdb86110afe13bf1167e039eaafad46b0949b2ee
- SHA256
  
  7da764b04ca560c0f609873250e5a4cddd281d1a0d75bffbaf9c376093152269
- SHA512
  
  c6e5b0ca1f69e818aad606a36b67f2d1c7341d4350a9dcef0d0773c943bb1c781e0a24a1bd809ab0fa4747867350494c58f5ffe223a0edafc311d41faa878e7f
- SSDEEP
  
  196608:WBIEoP1HSsimvlG2Ms0tbYPvXJQlHJCsA58Cr3Ox2B6lckvob:WaP1pimt2aJQlpC5dKcxb
Score

7^/10

spyware stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2