Overview

overview

10

Static

static

3

55c2663cfb...18.exe

windows7-x64

10

55c2663cfb...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    55c2663cfb4eb03f1e7d298fe4504d1a_JaffaCakes118
  • Size 282KB
  • Sample240718-cmy6aatfla
  • SHA256 c9fe44239070bb2a048ea3c044471112f340049cacb87522de5adbc74d687bb2
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
kronosbankerbotnetevasionpersistencespywarestealer

Malware Config

Targets

    • Target
      55c2663cfb4eb03f1e7d298fe4504d1a_JaffaCakes118
    • Size 282KB
    • SHA256 c9fe44239070bb2a048ea3c044471112f340049cacb87522de5adbc74d687bb2
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    kronosbankerbotnetevasionpersistencespywarestealer

    • Kronos

      bankerbotnetkronos

    • Modifies security service

      evasion

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks