Overview

overview

10

Static

static

7

6c581c3d2e...18.exe

windows7-x64

10

6c581c3d2e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6c581c3d2ed3ddc331b58eec30ef80f9_JaffaCakes118

  • Size

    5.7MB

  • Sample

    240724-w6yteateqd

  • MD5

    6c581c3d2ed3ddc331b58eec30ef80f9

  • SHA1

    731e6a70f80ebc461980d7761f5b2d784b7b65ea

  • SHA256

    b9b40c0a65cda77316171e1418c712f7179476ec53e5809cdc8ce6d85ca166d4

  • SHA512

    93211e7506304771b8778cdf4c39c172d5f0cd1be42ae422ac23011d22bc5dd0851721ad4afd0f2a6f49796ae02d2153b76fdf192cc6328182e3d27833e2373f

  • SSDEEP

    98304:GhJd2yY6fCE/6INxvoZsExcFPP4Nh1opEwY/5ODOTKCJ40+jCVQHBy/cHxH9Or:OvvY6fP68xAZsKcoY2OyTKljCqhoH

Score
10/10
pandastealershurkcredential_accessdiscoveryinfostealerspywarestealervmprotect

Malware Config

Targets

    • Target

      6c581c3d2ed3ddc331b58eec30ef80f9_JaffaCakes118

    • Size

      5.7MB

    • MD5

      6c581c3d2ed3ddc331b58eec30ef80f9

    • SHA1

      731e6a70f80ebc461980d7761f5b2d784b7b65ea

    • SHA256

      b9b40c0a65cda77316171e1418c712f7179476ec53e5809cdc8ce6d85ca166d4

    • SHA512

      93211e7506304771b8778cdf4c39c172d5f0cd1be42ae422ac23011d22bc5dd0851721ad4afd0f2a6f49796ae02d2153b76fdf192cc6328182e3d27833e2373f

    • SSDEEP

      98304:GhJd2yY6fCE/6INxvoZsExcFPP4Nh1opEwY/5ODOTKCJ40+jCVQHBy/cHxH9Or:OvvY6fP68xAZsKcoY2OyTKljCqhoH

    Score
    10/10
    pandastealershurkcredential_accessdiscoveryinfostealerspywarestealervmprotect

    • Panda Stealer payload

    • PandaStealer

      Panda Stealer is a fork of CollectorProject Stealer written in C++.

      stealerpandastealer

    • Shurk

      Shurk is an infostealer, written in C++ which appeared in 2021.

      infostealershurk

    • Shurk Stealer payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks