Overview

overview

10

Static

static

3

b1333fc270...18.exe

windows7-x64

10

b1333fc270...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b1333fc270e4378a88de9c016c0912e9_JaffaCakes118

  • Size

    836KB

  • Sample

    240616-cbjapaycrp

  • MD5

    b1333fc270e4378a88de9c016c0912e9

  • SHA1

    3cc2d548b5c6812b6b7322a64dfbce31bdcb35cc

  • SHA256

    6938bb5b3bd1c8666fef0c03e06d654752a1678888eab3946d7d46afa5f4be80

  • SHA512

    77e84e6538614c4966ce533d59adc0b17e46c54298b1e57e49b476b268d249f49a8bf1b1a9a0a618b2782f7ad6c483178dc6a7b1a69eed6c5fdc8d1526996a5c

  • SSDEEP

    12288:CyuHS2AlG6ollMcsVeuSrMUtSEY1UDLN64zSkK0RVmvXTzPo4dNDX+ZxBt6oLr57:Z0Lca5tSB1U9MkzLmfTc69Xix3JeQ

Score
10/10
massloggercollectionspywarestealer

Malware Config

Targets

    • Target

      b1333fc270e4378a88de9c016c0912e9_JaffaCakes118

    • Size

      836KB

    • MD5

      b1333fc270e4378a88de9c016c0912e9

    • SHA1

      3cc2d548b5c6812b6b7322a64dfbce31bdcb35cc

    • SHA256

      6938bb5b3bd1c8666fef0c03e06d654752a1678888eab3946d7d46afa5f4be80

    • SHA512

      77e84e6538614c4966ce533d59adc0b17e46c54298b1e57e49b476b268d249f49a8bf1b1a9a0a618b2782f7ad6c483178dc6a7b1a69eed6c5fdc8d1526996a5c

    • SSDEEP

      12288:CyuHS2AlG6ollMcsVeuSrMUtSEY1UDLN64zSkK0RVmvXTzPo4dNDX+ZxBt6oLr57:Z0Lca5tSB1U9MkzLmfTc69Xix3JeQ

    Score
    10/10
    massloggercollectionspywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks