General

  • Target

    b48995b40f916f1ae6a1a2a5b8127f13_JaffaCakes118

  • Size

    1.2MB

  • Sample

    240616-t17g9atglk

  • MD5

    b48995b40f916f1ae6a1a2a5b8127f13

  • SHA1

    4f9741110d556f4cb7d844d268aaadc7ba6802aa

  • SHA256

    811d7323fa48438a743e869bdb80f7276ad748f54795bb087222d492847ce3be

  • SHA512

    d7bca5a1f89af01dc41ffd94910b2c5f9ac7ea408c0596faeeaf21b2e861bf7f7a735d5797722c3392f9341b8e70343be37c82223fef063d8aa79abf547bbfd5

  • SSDEEP

    24576:s4TPK8m6lgMi4zVB8A+rCNGYFKbrJtgQkn2/n+De+8Y7/82C+jrGBnd8N:s4rRBlgKuA+rCNGIK5tgzn2/W+Y42FGy

Malware Config

Targets

    • Target

      b48995b40f916f1ae6a1a2a5b8127f13_JaffaCakes118

    • Size

      1.2MB

    • MD5

      b48995b40f916f1ae6a1a2a5b8127f13

    • SHA1

      4f9741110d556f4cb7d844d268aaadc7ba6802aa

    • SHA256

      811d7323fa48438a743e869bdb80f7276ad748f54795bb087222d492847ce3be

    • SHA512

      d7bca5a1f89af01dc41ffd94910b2c5f9ac7ea408c0596faeeaf21b2e861bf7f7a735d5797722c3392f9341b8e70343be37c82223fef063d8aa79abf547bbfd5

    • SSDEEP

      24576:s4TPK8m6lgMi4zVB8A+rCNGYFKbrJtgQkn2/n+De+8Y7/82C+jrGBnd8N:s4rRBlgKuA+rCNGIK5tgzn2/W+Y42FGy

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Matrix ATT&CK v13

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

Collection

Data from Local System

1
T1005

Tasks