Overview

overview

10

Static

static

3

3ece4bc95c...18.exe

windows7-x64

10

3ece4bc95c...18.exe

windows10-2004-x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3ece4bc95c4158f601a0201b75c2ef43_JaffaCakes118

  • Size

    2.8MB

  • Sample

    240712-zgmlmayhpr

  • MD5

    3ece4bc95c4158f601a0201b75c2ef43

  • SHA1

    a9931acff524b8c4062e0f507b11f2d17563bfcb

  • SHA256

    f11e0849228da364d6bd2787f97a97130b833b4f51cb1d3ba310f748cd954ac4

  • SHA512

    038967d9360b34355b58d9edcbedd6379d8ab48c15855539e0a1abf9d79b087baaeb2108e900c50b5951fc37e6ed621944d699eb4ab1920d3b49e897563f02d8

  • SSDEEP

    49152:cpxKMhvnm+qSJMCdd5zkyMm1bdP3AcYW7XrnjZT0/2J0Mox:NMhvnzVTzOUbn90/Mzo

Score
10/10
cryptbotdiscoveryspywarestealer

Malware Config

Targets

    • Target

      3ece4bc95c4158f601a0201b75c2ef43_JaffaCakes118

    • Size

      2.8MB

    • MD5

      3ece4bc95c4158f601a0201b75c2ef43

    • SHA1

      a9931acff524b8c4062e0f507b11f2d17563bfcb

    • SHA256

      f11e0849228da364d6bd2787f97a97130b833b4f51cb1d3ba310f748cd954ac4

    • SHA512

      038967d9360b34355b58d9edcbedd6379d8ab48c15855539e0a1abf9d79b087baaeb2108e900c50b5951fc37e6ed621944d699eb4ab1920d3b49e897563f02d8

    • SSDEEP

      49152:cpxKMhvnm+qSJMCdd5zkyMm1bdP3AcYW7XrnjZT0/2J0Mox:NMhvnzVTzOUbn90/Mzo

    Score
    10/10
    cryptbotdiscoveryspywarestealer

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

      spywarestealercryptbot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks