Overview

overview

7

Static

static

3

268ecefb37...18.exe

windows7-x64

7

268ecefb37...18.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    268ecefb37e85fadbb49455ab5af81a3_JaffaCakes118

  • Size

    142KB

  • Sample

    240704-22mhgavbjr

  • MD5

    268ecefb37e85fadbb49455ab5af81a3

  • SHA1

    7a65df2935658a2afa01f427cdd20b1b6123da6b

  • SHA256

    fd965d35ca0d4a7c0e2204ca56676d6566d5f3b4124f38cc6187a442fc400c4b

  • SHA512

    5755be900547d33cbecc6446cdda0f4f7344c9e17d6ef9c8b72b3b636036b90bbda87a697586d31231c91e06b0b0cfa07e3501b726483c73edf985d48a329387

  • SSDEEP

    1536:+f56J08AabpHN/RFnWrNpVKmRZ1m0YxNElnX/7oO3Ou5eJuZn0iJIFGS/luVWw81:W56so7nSNXPZ2xaZ5eYd1JINrw8

Score
7/10
persistencespywarestealer

Malware Config

Targets

    • Target

      268ecefb37e85fadbb49455ab5af81a3_JaffaCakes118

    • Size

      142KB

    • MD5

      268ecefb37e85fadbb49455ab5af81a3

    • SHA1

      7a65df2935658a2afa01f427cdd20b1b6123da6b

    • SHA256

      fd965d35ca0d4a7c0e2204ca56676d6566d5f3b4124f38cc6187a442fc400c4b

    • SHA512

      5755be900547d33cbecc6446cdda0f4f7344c9e17d6ef9c8b72b3b636036b90bbda87a697586d31231c91e06b0b0cfa07e3501b726483c73edf985d48a329387

    • SSDEEP

      1536:+f56J08AabpHN/RFnWrNpVKmRZ1m0YxNElnX/7oO3Ou5eJuZn0iJIFGS/luVWw81:W56so7nSNXPZ2xaZ5eYd1JINrw8

    Score
    7/10
    persistencespywarestealer

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks