General

  • Target

    6a9626a7549cdcfd96f1c940dcc6354b_JaffaCakes118

  • Size

    12KB

  • Sample

    240724-havj8awanb

  • MD5

    6a9626a7549cdcfd96f1c940dcc6354b

  • SHA1

    8e191cf22d400ec326c30e0a30d7ea5fcaf99cf1

  • SHA256

    b1a119dbe2174b9217f9fdb90bd6d1df738e6c48c7b69f8dcae17921ce6a5380

  • SHA512

    af422c51260024ad5b429e02f04e754ddd80e5b208b9b569e0f7b2d795b7dd780d318abbcb73d0a7e643f657b7c1b8345a0bfbf363495516992a8ea82b36048b

  • SSDEEP

    192:Pni1h7xkvwCmFlpGYhvpkuGD3vijvYkYa9IlAwtynN0QU:Pi1h7xkvwtFlFLwL6rYk/9AlyuQ

Malware Config

Extracted

Family

growtopia

C2

https://discord.com/api/webhooks/797902831101149214/R9M-X1hL5AsJg6f7hX5Y9MVjH_QuVsm7UbsgFpQPwnk85f6139T_x277LF5v1Hur8BrW

Attributes
  • payload_url

    https://cdn.discordapp.com/attachments/732523154639028265/732537877103116309/savedecrypter.exe

Targets

    • Target

      6a9626a7549cdcfd96f1c940dcc6354b_JaffaCakes118

    • Size

      12KB

    • MD5

      6a9626a7549cdcfd96f1c940dcc6354b

    • SHA1

      8e191cf22d400ec326c30e0a30d7ea5fcaf99cf1

    • SHA256

      b1a119dbe2174b9217f9fdb90bd6d1df738e6c48c7b69f8dcae17921ce6a5380

    • SHA512

      af422c51260024ad5b429e02f04e754ddd80e5b208b9b569e0f7b2d795b7dd780d318abbcb73d0a7e643f657b7c1b8345a0bfbf363495516992a8ea82b36048b

    • SSDEEP

      192:Pni1h7xkvwCmFlpGYhvpkuGD3vijvYkYa9IlAwtynN0QU:Pi1h7xkvwtFlFLwL6rYk/9AlyuQ

    • Growtopia

      Growtopa is an opensource modular stealer written in C#.

MITRE ATT&CK Enterprise v15

Tasks