General

  • Target

    54ac0ba851bc399367093c9a74d7ea64_JaffaCakes118

  • Size

    941KB

  • Sample

    240518-pfkqjaba91

  • MD5

    54ac0ba851bc399367093c9a74d7ea64

  • SHA1

    f5cce6d812890add46c34ef18d773f7d2c1d1032

  • SHA256

    496f26beb33fff369de4e425a51670236f669a0db67be31760363407cb3494ba

  • SHA512

    bda3bc20c2137efe5bb3da0d0fc25e4014113337d12b419a684a33dcad1efbe7c543a7ff8f6c4f87ed3931b8f9bca94292b827174eb485592697e7944b12b564

  • SSDEEP

    12288:XQbhex2teM2Lfzpl6+fcZfcNp3nCoKzN2GwH+lw+3ADMJl5MhNAulRCFx3LEo+C:2h1n2Ltlpm+x/KK+6ILL9f

Malware Config

Targets

    • Target

      54ac0ba851bc399367093c9a74d7ea64_JaffaCakes118

    • Size

      941KB

    • MD5

      54ac0ba851bc399367093c9a74d7ea64

    • SHA1

      f5cce6d812890add46c34ef18d773f7d2c1d1032

    • SHA256

      496f26beb33fff369de4e425a51670236f669a0db67be31760363407cb3494ba

    • SHA512

      bda3bc20c2137efe5bb3da0d0fc25e4014113337d12b419a684a33dcad1efbe7c543a7ff8f6c4f87ed3931b8f9bca94292b827174eb485592697e7944b12b564

    • SSDEEP

      12288:XQbhex2teM2Lfzpl6+fcZfcNp3nCoKzN2GwH+lw+3ADMJl5MhNAulRCFx3LEo+C:2h1n2Ltlpm+x/KK+6ILL9f

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger Main payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks