General
-
Target
9aa57ec1e10674582b36181788cb6e5c_JaffaCakes118
-
Size
571KB
-
Sample
240610-phmb5svfpr
-
MD5
9aa57ec1e10674582b36181788cb6e5c
-
SHA1
204b63af90168bd49591f05f2db4906ffff0a75d
-
SHA256
246af49565355a8604a3df23fece37dfef3a06c93ea5750fc3fd90d4375e234a
-
SHA512
7f480e22b784f6e56a3ab5a48a23bcfc5511e023830c048d9ef0add8f05826d31beab20493de1a0f17af1302490f62f58862b932765f4ea72aaa191aef0aa355
-
SSDEEP
12288:QdNspCFrDD+wnkp0J6rkKhBGYsuSH6z0fWjlOSEmWif3L+ANRzTm3z:8sp8rDD+r0J6rRBGrui00fWpEm/nN1m3
Malware Config
Targets
-
-
Target
9aa57ec1e10674582b36181788cb6e5c_JaffaCakes118
-
Size
571KB
-
MD5
9aa57ec1e10674582b36181788cb6e5c
-
SHA1
204b63af90168bd49591f05f2db4906ffff0a75d
-
SHA256
246af49565355a8604a3df23fece37dfef3a06c93ea5750fc3fd90d4375e234a
-
SHA512
7f480e22b784f6e56a3ab5a48a23bcfc5511e023830c048d9ef0add8f05826d31beab20493de1a0f17af1302490f62f58862b932765f4ea72aaa191aef0aa355
-
SSDEEP
12288:QdNspCFrDD+wnkp0J6rkKhBGYsuSH6z0fWjlOSEmWif3L+ANRzTm3z:8sp8rDD+r0J6rRBGrui00fWpEm/nN1m3
Score10/10-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main payload
-
Beds Protector Packer
Detects Beds Protector packer used to load .NET malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-