00942580f3d16d2f6844b1852625027fb3249d9517d829c6b333303b3ca9a9b6 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3161d41561203d11887d4f9f942cd27b_JaffaCakes118
Size

4.6MB
Sample

240709-whcw2awgnr
MD5

3161d41561203d11887d4f9f942cd27b
SHA1

2aeb674a8bee8201f1fb6e3c3b232fcd002eea98
SHA256

00942580f3d16d2f6844b1852625027fb3249d9517d829c6b333303b3ca9a9b6
SHA512

46920812198e9bb76731e8ce47186c259d85f86dad6dff923ce2d14a76bd8841f5b8ea8f1ecf5f847412398491eb262173fd6eaaab3a682aa5a908ce52dca708
SSDEEP

98304:KXM33vrdXO31aL6mhOvpZhivcrmEtrM7OAOd2DGRH4Ub/QwuXz9uCj2uhihCidtP:CM3/QgQZUvcyEtr+OTR4UEXhuCRihJd5

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  3161d41561203d11887d4f9f942cd27b_JaffaCakes118
- Size
  
  4.6MB
- MD5
  
  3161d41561203d11887d4f9f942cd27b
- SHA1
  
  2aeb674a8bee8201f1fb6e3c3b232fcd002eea98
- SHA256
  
  00942580f3d16d2f6844b1852625027fb3249d9517d829c6b333303b3ca9a9b6
- SHA512
  
  46920812198e9bb76731e8ce47186c259d85f86dad6dff923ce2d14a76bd8841f5b8ea8f1ecf5f847412398491eb262173fd6eaaab3a682aa5a908ce52dca708
- SSDEEP
  
  98304:KXM33vrdXO31aL6mhOvpZhivcrmEtrM7OAOd2DGRH4Ub/QwuXz9uCj2uhihCidtP:CM3/QgQZUvcyEtr+OTR4UEXhuCRihJd5
Score

7^/10

spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2