abe206d59751496351baa7b7b6408c1263bee203cfddcaf7d48e31f62a0b4939 | Triage

Sharing

General

Target

2f638bbf1afac418ff54d0b41fb46f94_JaffaCakes118
Size

567KB
Sample

240709-hr4t8atfna
MD5

2f638bbf1afac418ff54d0b41fb46f94
SHA1

666f45633710b57a9350a8ce2f534d505245dd37
SHA256

abe206d59751496351baa7b7b6408c1263bee203cfddcaf7d48e31f62a0b4939
SHA512

cfb81c94749848047e1fb62195517b1aff30880ec170e76c9ce85683d75803c9ff0e38168b21bfe2fc92d428948bd769ced6c81dcfbe8290e214dea63f935e1c
SSDEEP

12288:+OLtXrAYDLH9tK1q5mUo4K55Ke4ao4X0k/NBcDOnH:TUYD7fKkIcKjKvBGnnH

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  2f638bbf1afac418ff54d0b41fb46f94_JaffaCakes118
- Size
  
  567KB
- MD5
  
  2f638bbf1afac418ff54d0b41fb46f94
- SHA1
  
  666f45633710b57a9350a8ce2f534d505245dd37
- SHA256
  
  abe206d59751496351baa7b7b6408c1263bee203cfddcaf7d48e31f62a0b4939
- SHA512
  
  cfb81c94749848047e1fb62195517b1aff30880ec170e76c9ce85683d75803c9ff0e38168b21bfe2fc92d428948bd769ced6c81dcfbe8290e214dea63f935e1c
- SSDEEP
  
  12288:+OLtXrAYDLH9tK1q5mUo4K55Ke4ao4X0k/NBcDOnH:TUYD7fKkIcKjKvBGnnH
Score

7^/10

spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2