General
-
Target
9d5f740b7d5809ea25730e64b4fa912d_JaffaCakes118
-
Size
1.6MB
-
Sample
240611-hwzq3aygqp
-
MD5
9d5f740b7d5809ea25730e64b4fa912d
-
SHA1
471105c6d5d9ea176776a63290b8e5afeb2b8490
-
SHA256
9258d2295790e426975b82410c873426cdce760ea363bbe4c3b3adbbcecd0798
-
SHA512
0a5410b01fca40457da0881ab011a9ad70a72f69b961b88fa091d812dd84b0e76094702d9f519a0743997000e9f1ec66d71120db3f775ae65079585047c96f1d
-
SSDEEP
24576:7ewJ9gLO8jEHWwZrQ8dKooBNYP11tJEx7KWACg/PkYwgayeA2vS7kEroMYMt28Mo:tJ9gw7ZPdNWNIJEx9A2gAKwErYjErJ5
Malware Config
Targets
-
-
Target
SOA SWIFT COPY_PDF_________________________________________.exe
-
Size
1.8MB
-
MD5
556382e43e072b9e5d0bf902ada6ddef
-
SHA1
5fe979dd793a9f2538e14c50537d76c81f97315c
-
SHA256
5c25185beb2246bba9f097cb915dcc1560c80527c6750d6da5737c29de2db217
-
SHA512
22f0b8c3d41f71374a5001cebd5a3012002a03d0bf98e896826198f580999c10128ed3d269d6d1d9e2d972a5385fe470ce0bc1f2f3afa88f077f8598cd727b11
-
SSDEEP
24576:88E2VqRIdmp8pU+7CKSuFIwZAdmW8g+SIXWJLLQYRDhOUAwf72793sUxCMf:tIRumef7TBA/FKWdc+9/7279cG3f
Score10/10-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-