Overview

overview

10

Static

static

3

767db86316...18.exe

windows7-x64

10

767db86316...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    767db863164ec054813a61fc1c469b60_JaffaCakes118

  • Size

    25.9MB

  • Sample

    240727-bhyhhszdqb

  • MD5

    767db863164ec054813a61fc1c469b60

  • SHA1

    cf1f5541ea6fcd245d725b89e4e2309b895ab4f7

  • SHA256

    b13330d8e458c80c87cc8420ee96d9b1bc0e62db607c569fbe5ef7f1abd9bc31

  • SHA512

    c723996862f4368555af5cd3435ffc7207e9b7f945369ff543b1de5e527a26bed0cd18389ca64bb95085426b9d7f7d2753b8995de2bcfd02b882ac3f4a4f16ed

  • SSDEEP

    786432:zfzDs7aZXBWhs6cets5XOjehnRLy3f3xfDcgH:zffYavetwmehntyJff

Score
10/10
pandastealershurkcredential_accessdiscoveryinfostealerstealervmprotect

Malware Config

Targets

    • Target

      767db863164ec054813a61fc1c469b60_JaffaCakes118

    • Size

      25.9MB

    • MD5

      767db863164ec054813a61fc1c469b60

    • SHA1

      cf1f5541ea6fcd245d725b89e4e2309b895ab4f7

    • SHA256

      b13330d8e458c80c87cc8420ee96d9b1bc0e62db607c569fbe5ef7f1abd9bc31

    • SHA512

      c723996862f4368555af5cd3435ffc7207e9b7f945369ff543b1de5e527a26bed0cd18389ca64bb95085426b9d7f7d2753b8995de2bcfd02b882ac3f4a4f16ed

    • SSDEEP

      786432:zfzDs7aZXBWhs6cets5XOjehnRLy3f3xfDcgH:zffYavetwmehntyJff

    Score
    10/10
    pandastealershurkcredential_accessdiscoveryinfostealerstealervmprotect

    • Panda Stealer payload

    • PandaStealer

      Panda Stealer is a fork of CollectorProject Stealer written in C++.

      stealerpandastealer

    • Shurk

      Shurk is an infostealer, written in C++ which appeared in 2021.

      infostealershurk

    • Shurk Stealer payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks