Overview

overview

10

Static

static

3

316675ee93...18.exe

windows7-x64

10

316675ee93...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    316675ee932f3deec4d3eaa36347db03_JaffaCakes118

  • Size

    870KB

  • Sample

    240729-b59t3a1crc

  • MD5

    316675ee932f3deec4d3eaa36347db03

  • SHA1

    c8db9092049f42be776ca2255caaeafccbe022d1

  • SHA256

    6a164f48d3ed08f48e0817b3e5fe2aa579a2c57e7c7c5ab49a38d7cbd3715ade

  • SHA512

    ad62920a54508995e04cd97de87186d73e5c9a1af559a0257e43d9973b62c6d1c39a17813e196e625748f25a9ec30ad649446592060e81e5699d7182d3f896f3

  • SSDEEP

    24576:dMPqoKAWf98bx4lXxQScb5+EC6c2u8di69Z:dMCoKAWf9VxQbVHi8l9

Score
10/10
massloggercollectioncredential_accessdiscoveryspywarestealer

Malware Config

Targets

    • Target

      316675ee932f3deec4d3eaa36347db03_JaffaCakes118

    • Size

      870KB

    • MD5

      316675ee932f3deec4d3eaa36347db03

    • SHA1

      c8db9092049f42be776ca2255caaeafccbe022d1

    • SHA256

      6a164f48d3ed08f48e0817b3e5fe2aa579a2c57e7c7c5ab49a38d7cbd3715ade

    • SHA512

      ad62920a54508995e04cd97de87186d73e5c9a1af559a0257e43d9973b62c6d1c39a17813e196e625748f25a9ec30ad649446592060e81e5699d7182d3f896f3

    • SSDEEP

      24576:dMPqoKAWf98bx4lXxQScb5+EC6c2u8di69Z:dMCoKAWf9VxQbVHi8l9

    Score
    10/10
    massloggercollectioncredential_accessdiscoveryspywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks