Overview

overview

10

Static

static

3

bb170d513d...18.exe

windows7-x64

10

bb170d513d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bb170d513dc66dfe00c946a19359f358_JaffaCakes118

  • Size

    2.6MB

  • Sample

    240618-g5exksvenp

  • MD5

    bb170d513dc66dfe00c946a19359f358

  • SHA1

    e0a573a2eb1e8f935566b6d950fb7c94eb87c018

  • SHA256

    e269d898aca6d7665fb07a0497743757f3019d0b576241ec4e2425476bf7ccaa

  • SHA512

    1e324b23c36910e7d57da02e1bcda534293ed430d0e4bea44cd561d5e70c776b50a42a571a9506d291fa57538ea378bd9f47663b63c0cf8222925ee6cc8f4698

  • SSDEEP

    49152:5ryFHSTiB1cGZYaQmRcX0Ojm6i0QgZdRTq880BQC5Vpkb8lKyoZANP5:5rA6GZwmA0Wm6CgXRTq/0r5wboKyHR

Score
10/10
ardamaxhawkeyecollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      bb170d513dc66dfe00c946a19359f358_JaffaCakes118

    • Size

      2.6MB

    • MD5

      bb170d513dc66dfe00c946a19359f358

    • SHA1

      e0a573a2eb1e8f935566b6d950fb7c94eb87c018

    • SHA256

      e269d898aca6d7665fb07a0497743757f3019d0b576241ec4e2425476bf7ccaa

    • SHA512

      1e324b23c36910e7d57da02e1bcda534293ed430d0e4bea44cd561d5e70c776b50a42a571a9506d291fa57538ea378bd9f47663b63c0cf8222925ee6cc8f4698

    • SSDEEP

      49152:5ryFHSTiB1cGZYaQmRcX0Ojm6i0QgZdRTq880BQC5Vpkb8lKyoZANP5:5rA6GZwmA0Wm6CgXRTq/0r5wboKyHR

    Score
    10/10
    ardamaxhawkeyecollectionkeyloggerpersistencespywarestealertrojan

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks