Overview

overview

7

Static

static

7

46b3299b1f...18.exe

windows7-x64

7

46b3299b1f...18.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    46b3299b1f4dc2c88223fbf7db824fbe_JaffaCakes118

  • Size

    218KB

  • Sample

    240714-vfkcnaygqn

  • MD5

    46b3299b1f4dc2c88223fbf7db824fbe

  • SHA1

    6839e906e19199bca4e1d80ec416e13a482906ef

  • SHA256

    03a9e366c41345a2b52ec65c4c0beb91599c8aef0c1632b3da869072734c2a13

  • SHA512

    faa2b3f7a40fbaab65e633c735ea62516e0d0eec518a9b58c79a9907282bd1312ad9a0f33cb2b8e19382d7828fceac7130d11f1e4016911529e2da6d782d742c

  • SSDEEP

    3072:XFToY0hbid6a2MGkfNr3ak/gWpIV0AN3cU4qFhbGUbtB+DCqdd9TGpw2gLl6CRLK:l2U6a2sfNKkRg0dlq7VJBNqxipw2grLK

Score
7/10
persistencespywarestealerupx

Malware Config

Targets

    • Target

      46b3299b1f4dc2c88223fbf7db824fbe_JaffaCakes118

    • Size

      218KB

    • MD5

      46b3299b1f4dc2c88223fbf7db824fbe

    • SHA1

      6839e906e19199bca4e1d80ec416e13a482906ef

    • SHA256

      03a9e366c41345a2b52ec65c4c0beb91599c8aef0c1632b3da869072734c2a13

    • SHA512

      faa2b3f7a40fbaab65e633c735ea62516e0d0eec518a9b58c79a9907282bd1312ad9a0f33cb2b8e19382d7828fceac7130d11f1e4016911529e2da6d782d742c

    • SSDEEP

      3072:XFToY0hbid6a2MGkfNr3ak/gWpIV0AN3cU4qFhbGUbtB+DCqdd9TGpw2gLl6CRLK:l2U6a2sfNKkRg0dlq7VJBNqxipw2grLK

    Score
    7/10
    persistencespywarestealerupx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks