Overview

overview

10

Static

static

7

1861250efe...18.exe

windows7-x64

10

1861250efe...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1861250efe0e7988633c541e03c32400_JaffaCakes118

  • Size

    425KB

  • Sample

    240628-cdvrhavfjh

  • MD5

    1861250efe0e7988633c541e03c32400

  • SHA1

    f50515402410541e11f75d5e30c938e7e9b44162

  • SHA256

    d545b89ec3f0c7be9df7dab6ce41a1d199ca84a7606e896eecbce929742633c2

  • SHA512

    c024a0ea2c025851e42f2ab20438d5c9a26048f868b186678329cbe55dca2e381ff2eac3b67872eadad584f8e263ebb21a35ee37b76910259f36ae55e42139b7

  • SSDEEP

    6144:TlZ/zUMu4pDSxsCMRzf7x3SfS1JAzXBtL76lSZaOfybrSCTKslE4/nZ8N98c:THLUMuiv9RgfSjAzRty8aO6nrKsNZit

Score
10/10
persistencespywarestealerupx

Malware Config

Targets

    • Target

      1861250efe0e7988633c541e03c32400_JaffaCakes118

    • Size

      425KB

    • MD5

      1861250efe0e7988633c541e03c32400

    • SHA1

      f50515402410541e11f75d5e30c938e7e9b44162

    • SHA256

      d545b89ec3f0c7be9df7dab6ce41a1d199ca84a7606e896eecbce929742633c2

    • SHA512

      c024a0ea2c025851e42f2ab20438d5c9a26048f868b186678329cbe55dca2e381ff2eac3b67872eadad584f8e263ebb21a35ee37b76910259f36ae55e42139b7

    • SSDEEP

      6144:TlZ/zUMu4pDSxsCMRzf7x3SfS1JAzXBtL76lSZaOfybrSCTKslE4/nZ8N98c:THLUMuiv9RgfSjAzRty8aO6nrKsNZit

    Score
    10/10
    persistencespywarestealerupx

    • Modifies WinLogon for persistence

      persistence

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks