184a00c946b2d12121fd571d1353c1e42c26ee639487daaa65c1d574d6a45129 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

72d80791d84ef7e6b6321a86ce7dd376_JaffaCakes118
Size

110KB
Sample

240726-gqhpxszgll
MD5

72d80791d84ef7e6b6321a86ce7dd376
SHA1

54f8def8c713ae20cd5374a7202c5e98a94e90f9
SHA256

184a00c946b2d12121fd571d1353c1e42c26ee639487daaa65c1d574d6a45129
SHA512

c08746af6ec54314231388a9eacc16fd24006c4f30c3808d27108fb1232480ddbc00c918ea49682eb073373cc6250111c91ccb20c8c2a8612df8d4d720476471
SSDEEP

3072:Mu9EPmU6N6KVSsZ0ZJCETMmjOjgA1D8lN7jvl:VGPC0ZJCwMQOvpm

Score

10^/10

discovery persistence spyware stealer upx

Malware Config

Targets

- Target
  
  72d80791d84ef7e6b6321a86ce7dd376_JaffaCakes118
- Size
  
  110KB
- MD5
  
  72d80791d84ef7e6b6321a86ce7dd376
- SHA1
  
  54f8def8c713ae20cd5374a7202c5e98a94e90f9
- SHA256
  
  184a00c946b2d12121fd571d1353c1e42c26ee639487daaa65c1d574d6a45129
- SHA512
  
  c08746af6ec54314231388a9eacc16fd24006c4f30c3808d27108fb1232480ddbc00c918ea49682eb073373cc6250111c91ccb20c8c2a8612df8d4d720476471
- SSDEEP
  
  3072:Mu9EPmU6N6KVSsZ0ZJCETMmjOjgA1D8lN7jvl:VGPC0ZJCwMQOvpm
Score

10^/10

discovery persistence spyware stealer upx
- Modifies WinLogon for persistence
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealerupx

behavioral2