General

  • Target

    71f5dfe268fa0f58b9ea83ee73cc6a7b_JaffaCakes118

  • Size

    355KB

  • Sample

    240726-a8le7swbnp

  • MD5

    71f5dfe268fa0f58b9ea83ee73cc6a7b

  • SHA1

    45d5ed4d07e6856ac05666d39c7392c8f299f597

  • SHA256

    9cd83aa9c486ba40e5f917c9c2be42081253228ee318c350b8a43fdb36b56c72

  • SHA512

    16e35e7b07a8d026e625ee9d9f5f106b6c9eb993e5bf9704fc44dac886e21bc7f1ab3b34d6fd8f0d141e20117c70fa4346a626abed20ef7d9841dd72c0c02718

  • SSDEEP

    6144:ChZgBciIeELH7B225Mc0JHDZp4A7cfLE2DYJwVG/jy5RJ68lhjZzvbA:uSpQw2H0dZ+AcYJw0jGJ6gVZ7E

Malware Config

Targets

    • Target

      71f5dfe268fa0f58b9ea83ee73cc6a7b_JaffaCakes118

    • Size

      355KB

    • MD5

      71f5dfe268fa0f58b9ea83ee73cc6a7b

    • SHA1

      45d5ed4d07e6856ac05666d39c7392c8f299f597

    • SHA256

      9cd83aa9c486ba40e5f917c9c2be42081253228ee318c350b8a43fdb36b56c72

    • SHA512

      16e35e7b07a8d026e625ee9d9f5f106b6c9eb993e5bf9704fc44dac886e21bc7f1ab3b34d6fd8f0d141e20117c70fa4346a626abed20ef7d9841dd72c0c02718

    • SSDEEP

      6144:ChZgBciIeELH7B225Mc0JHDZp4A7cfLE2DYJwVG/jy5RJ68lhjZzvbA:uSpQw2H0dZ+AcYJw0jGJ6gVZ7E

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks