Overview

overview

10

Static

static

3

SOA SWIFT ...__.exe

windows7-x64

10

SOA SWIFT ...__.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9d5f740b7d5809ea25730e64b4fa912d_JaffaCakes118

  • Size

    1.6MB

  • Sample

    240611-hwzq3aygqp

  • MD5

    9d5f740b7d5809ea25730e64b4fa912d

  • SHA1

    471105c6d5d9ea176776a63290b8e5afeb2b8490

  • SHA256

    9258d2295790e426975b82410c873426cdce760ea363bbe4c3b3adbbcecd0798

  • SHA512

    0a5410b01fca40457da0881ab011a9ad70a72f69b961b88fa091d812dd84b0e76094702d9f519a0743997000e9f1ec66d71120db3f775ae65079585047c96f1d

  • SSDEEP

    24576:7ewJ9gLO8jEHWwZrQ8dKooBNYP11tJEx7KWACg/PkYwgayeA2vS7kEroMYMt28Mo:tJ9gw7ZPdNWNIJEx9A2gAKwErYjErJ5

Score
10/10
massloggercollectionspywarestealerupx

Malware Config

Targets

    • Target

      SOA SWIFT COPY_PDF_________________________________________.exe

    • Size

      1.8MB

    • MD5

      556382e43e072b9e5d0bf902ada6ddef

    • SHA1

      5fe979dd793a9f2538e14c50537d76c81f97315c

    • SHA256

      5c25185beb2246bba9f097cb915dcc1560c80527c6750d6da5737c29de2db217

    • SHA512

      22f0b8c3d41f71374a5001cebd5a3012002a03d0bf98e896826198f580999c10128ed3d269d6d1d9e2d972a5385fe470ce0bc1f2f3afa88f077f8598cd727b11

    • SSDEEP

      24576:88E2VqRIdmp8pU+7CKSuFIwZAdmW8g+SIXWJLLQYRDhOUAwf72793sUxCMf:tIRumef7TBA/FKWdc+9/7279cG3f

    Score
    10/10
    massloggercollectionspywarestealerupx

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks