General

  • Target

    71fb3ed4bf17e328c045a062fbf0895e_JaffaCakes118

  • Size

    2.3MB

  • Sample

    240525-pwcd4abg9z

  • MD5

    71fb3ed4bf17e328c045a062fbf0895e

  • SHA1

    cd4c819556e23a1919e9a8cf3d451455bf1696d7

  • SHA256

    0f86e468ec6513a931bbc2b21070299348662cea4345c922d258a538115e32cf

  • SHA512

    66b10b40604d42bf3bfb6cbd9f8def391293d63a6f5970cf25a1dcd8f714fafa3c7bbb0e855126abe466adc46baae6c5673619d894b17134d7fb8d0ac2485324

  • SSDEEP

    49152:3hSC8yWCkKGisG73vpICdFlF3rKiyNutJTY3cN6qO1w9jQD:MC8PbLf05RrKiPY3Ie1Sj

Malware Config

Extracted

Family

stealthworker

Version

3.11

C2

http://176.121.14.113:8888

Targets

    • Target

      71fb3ed4bf17e328c045a062fbf0895e_JaffaCakes118

    • Size

      2.3MB

    • MD5

      71fb3ed4bf17e328c045a062fbf0895e

    • SHA1

      cd4c819556e23a1919e9a8cf3d451455bf1696d7

    • SHA256

      0f86e468ec6513a931bbc2b21070299348662cea4345c922d258a538115e32cf

    • SHA512

      66b10b40604d42bf3bfb6cbd9f8def391293d63a6f5970cf25a1dcd8f714fafa3c7bbb0e855126abe466adc46baae6c5673619d894b17134d7fb8d0ac2485324

    • SSDEEP

      49152:3hSC8yWCkKGisG73vpICdFlF3rKiyNutJTY3cN6qO1w9jQD:MC8PbLf05RrKiPY3Ie1Sj

    • StealthWorker

      StealthWorker is golang-based brute force malware.

    • Drops startup file

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Matrix

Tasks