General

  • Target

    916740096f7fb73f2e2b8ee87deaf675_JaffaCakes118

  • Size

    593KB

  • Sample

    240603-l8gykaba2x

  • MD5

    916740096f7fb73f2e2b8ee87deaf675

  • SHA1

    90bf01fafbd4353f295ba7987436a1950a138152

  • SHA256

    557f4c234d26b35a5b4a65357b1b05b84e3ece6c59fcb265083b1545343bc854

  • SHA512

    133d638202f19737700ab8d7aecb50d54ff3b0fe92def121c5125b43d2c01a2bf6c70172b0bb68341d97b1fa904378c5dff5115325a6aae6f46f552ff2cf16c5

  • SSDEEP

    12288:dAAkeAPcDL+36QCKyR/ZLJLUf9snBS4csPYae6qfzsTC4:dBZhhUF54clNf7sTl

Malware Config

Targets

    • Target

      916740096f7fb73f2e2b8ee87deaf675_JaffaCakes118

    • Size

      593KB

    • MD5

      916740096f7fb73f2e2b8ee87deaf675

    • SHA1

      90bf01fafbd4353f295ba7987436a1950a138152

    • SHA256

      557f4c234d26b35a5b4a65357b1b05b84e3ece6c59fcb265083b1545343bc854

    • SHA512

      133d638202f19737700ab8d7aecb50d54ff3b0fe92def121c5125b43d2c01a2bf6c70172b0bb68341d97b1fa904378c5dff5115325a6aae6f46f552ff2cf16c5

    • SSDEEP

      12288:dAAkeAPcDL+36QCKyR/ZLJLUf9snBS4csPYae6qfzsTC4:dBZhhUF54clNf7sTl

    • Echelon

      Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks