Overview

overview

7

Static

static

1

5c4f6ac9d5...18.exe

windows7-x64

7

5c4f6ac9d5...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5c4f6ac9d58bc9febb7896befde45c61_JaffaCakes118

  • Size

    876KB

  • Sample

    240719-rpks1avhkn

  • MD5

    5c4f6ac9d58bc9febb7896befde45c61

  • SHA1

    c96109055af40a59f11ed41f87767315769b0d12

  • SHA256

    d28b763e5e4dc421a27fb29de7f6c296222669a853fabcc928765c9bd63e6993

  • SHA512

    e69d7c8a6726e63702ebbd514bb97112f3a31784eeaa0a2650f0b0a1d749bd27bac670dbe955bda607aca6376197b50dfff99533c0a509445ff7d7f50a4976b8

  • SSDEEP

    12288:YwXsUPwIc74G+16gA0Xp2Wfd5mI1N9M+tTSpLnWFY9uFIrpWh9HAApRP7UG3fQ:YELZc7451Zr5mwisTIniP7RYGv

Score
7/10
persistencespywarestealer

Malware Config

Targets

    • Target

      5c4f6ac9d58bc9febb7896befde45c61_JaffaCakes118

    • Size

      876KB

    • MD5

      5c4f6ac9d58bc9febb7896befde45c61

    • SHA1

      c96109055af40a59f11ed41f87767315769b0d12

    • SHA256

      d28b763e5e4dc421a27fb29de7f6c296222669a853fabcc928765c9bd63e6993

    • SHA512

      e69d7c8a6726e63702ebbd514bb97112f3a31784eeaa0a2650f0b0a1d749bd27bac670dbe955bda607aca6376197b50dfff99533c0a509445ff7d7f50a4976b8

    • SSDEEP

      12288:YwXsUPwIc74G+16gA0Xp2Wfd5mI1N9M+tTSpLnWFY9uFIrpWh9HAApRP7UG3fQ:YELZc7451Zr5mwisTIniP7RYGv

    Score
    7/10
    persistencespywarestealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks