Overview

overview

10

Static

static

3

b9023c34e1...18.exe

windows7-x64

10

b9023c34e1...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b9023c34e1e17a8494990b6dc35afb73_JaffaCakes118

  • Size

    913KB

  • Sample

    240617-vjcrzszhpr

  • MD5

    b9023c34e1e17a8494990b6dc35afb73

  • SHA1

    681708863a6775a9d7fd01b6309491eac0c2a3f0

  • SHA256

    e5c9691f51404bd8f320749285c4bcf595fbed53931af1424551fb5f5b9c594f

  • SHA512

    c19c6f1256b0ce80f920826c99466f45a0dc878d7672cea3a1e148fda826ba949b42980d22d5fdd3f93ce8dc3abf75adb27ebd7e20ca79d812c69819c0d40b6b

  • SSDEEP

    12288:IMfTlrtv2zv1gv7j2YJ3ulWEP32hzrDla1a1v/zumVDqJKStGiKgGFOB8MG/9Gi7:zrk2DjLOmh3xV/LVmrvK7OB8MiGWic

Score
10/10
massloggercollectionspywarestealer

Malware Config

Targets

    • Target

      b9023c34e1e17a8494990b6dc35afb73_JaffaCakes118

    • Size

      913KB

    • MD5

      b9023c34e1e17a8494990b6dc35afb73

    • SHA1

      681708863a6775a9d7fd01b6309491eac0c2a3f0

    • SHA256

      e5c9691f51404bd8f320749285c4bcf595fbed53931af1424551fb5f5b9c594f

    • SHA512

      c19c6f1256b0ce80f920826c99466f45a0dc878d7672cea3a1e148fda826ba949b42980d22d5fdd3f93ce8dc3abf75adb27ebd7e20ca79d812c69819c0d40b6b

    • SSDEEP

      12288:IMfTlrtv2zv1gv7j2YJ3ulWEP32hzrDla1a1v/zumVDqJKStGiKgGFOB8MG/9Gi7:zrk2DjLOmh3xV/LVmrvK7OB8MiGWic

    Score
    10/10
    massloggercollectionspywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks