Overview

overview

10

Static

static

7

254ff9b877...18.exe

windows7-x64

10

254ff9b877...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    254ff9b877035e9f65e17d66b80a948d_JaffaCakes118

  • Size

    4.3MB

  • Sample

    240728-1e3qhawbqq

  • MD5

    254ff9b877035e9f65e17d66b80a948d

  • SHA1

    531a38c973ba71526373add65d992291c84cbc5b

  • SHA256

    43048edb033b556a954c693a6fa1b4a347e56cd4455fbf15abd359ff17eafbfa

  • SHA512

    c5c745167ffe7842ef357dad5f1bc06a7fc946ffd81b4bd3314d882ba701ac3069abff9b8b96304d0fd5d244e9826fd59ab3edf92befbfc677e66d53e0faf838

  • SSDEEP

    98304:CbEukVuQ7GVqCDS91OWDkrCV05B6owz3AJOgb7T4gk:MLkVR7wNDlWDeHB2s

Score
10/10
fabookiediscoverypersistencespywarestealerupxvmprotect

Malware Config

Targets

    • Target

      254ff9b877035e9f65e17d66b80a948d_JaffaCakes118

    • Size

      4.3MB

    • MD5

      254ff9b877035e9f65e17d66b80a948d

    • SHA1

      531a38c973ba71526373add65d992291c84cbc5b

    • SHA256

      43048edb033b556a954c693a6fa1b4a347e56cd4455fbf15abd359ff17eafbfa

    • SHA512

      c5c745167ffe7842ef357dad5f1bc06a7fc946ffd81b4bd3314d882ba701ac3069abff9b8b96304d0fd5d244e9826fd59ab3edf92befbfc677e66d53e0faf838

    • SSDEEP

      98304:CbEukVuQ7GVqCDS91OWDkrCV05B6owz3AJOgb7T4gk:MLkVR7wNDlWDeHB2s

    Score
    10/10
    fabookiediscoverypersistencespywarestealerupxvmprotect

    • Detect Fabookie payload

    • Fabookie

      Fabookie is facebook account info stealer.

      spywarestealerfabookie

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks