3f62d973a097dcfc1feb0b25d7f51cf1677acad351b33e4456c6c98a69367cb2 | Triage

Sharing

General

Target

78ae82aa7a4e656f7ba330a271aa020c_JaffaCakes118
Size

72KB
Sample

240527-lf5h6aga93
MD5

78ae82aa7a4e656f7ba330a271aa020c
SHA1

bd5f84224c935d63ccd00d7fd1232081713bb50d
SHA256

3f62d973a097dcfc1feb0b25d7f51cf1677acad351b33e4456c6c98a69367cb2
SHA512

7e68bf562eeb236fa1b86077a6eb357fd023e314f2bdd885d5e7f67d7db89cfa54dd25bc9d664ad694cc27ae664eed273b1b20d8f2d62c6952fc9b99b6c60e05
SSDEEP

1536:XPvIsj0aD5J857/w+NWUIgEEyRhf0iYWZTcPKcx9TgN4MWScTQM8RmUiM6:XPvx0Sy57jgUIPYHzIuMPKzL

Score

10^/10

evasion persistence spyware stealer

Malware Config

Targets

- Target
  
  IMG0525040502016-JPEG.www.facebook.com.com
- Size
  
  137KB
- MD5
  
  dfb3df115d74fe506bd6fd4a27dd2ccf
- SHA1
  
  6c264ac6b91d9380968329036e17ceb7522bdb4a
- SHA256
  
  e99360d1c28e5c269d70b934646fca7ba72c2a0747d4fc4079f8dd0335370f0c
- SHA512
  
  b86df00da8686816018ea45b70a6418fc9a47b390dbbda50533bfc0fbaf8e082f7469b26601b7e5ef61942d608b5b01e75062b779882e8eb4d494449f3dc5a7b
- SSDEEP
  
  3072:s5/H/0ltUA7RfNBOB5nRz6bBo1z8Dr1Zl/KLs:s5X0ltUPB1RzWBo1z8Dr12Ls
Score

10^/10

evasion persistence spyware stealer
- Modifies security service
  evasion
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencespywarestealer

behavioral2