General

  • Target

    283aeb8dfa6c77eea35b2b9bac39f670_JaffaCakes118

  • Size

    1.3MB

  • Sample

    240706-mkhqmawdnj

  • MD5

    283aeb8dfa6c77eea35b2b9bac39f670

  • SHA1

    97874c5720875e87e72fe2814fa71c3ebc685c1b

  • SHA256

    86074b8645dfee9075aff87ce515385b90b12cb01d61704d66b006ea677438c0

  • SHA512

    3d1e110a0927d38ffdca0591693feab169979fddd3276e04bd3da7eda8b3d7770221345684941acd5f70831d28bfb8324e94b06be35f9d1db5c454012f4866e8

  • SSDEEP

    24576:Igh05KKSKOyddoHtK6nvTyfwOsAF/ANmzV3lw69m+XpLaPGAzMJD2r:BqkttvTFO/AYm+Zy/MJI

Malware Config

Targets

    • Target

      283aeb8dfa6c77eea35b2b9bac39f670_JaffaCakes118

    • Size

      1.3MB

    • MD5

      283aeb8dfa6c77eea35b2b9bac39f670

    • SHA1

      97874c5720875e87e72fe2814fa71c3ebc685c1b

    • SHA256

      86074b8645dfee9075aff87ce515385b90b12cb01d61704d66b006ea677438c0

    • SHA512

      3d1e110a0927d38ffdca0591693feab169979fddd3276e04bd3da7eda8b3d7770221345684941acd5f70831d28bfb8324e94b06be35f9d1db5c454012f4866e8

    • SSDEEP

      24576:Igh05KKSKOyddoHtK6nvTyfwOsAF/ANmzV3lw69m+XpLaPGAzMJD2r:BqkttvTFO/AYm+Zy/MJI

    • StormKitty

      StormKitty is an open source info stealer written in C#.

    • StormKitty payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks