Overview

overview

10

Static

static

3

5099585c34...18.exe

windows7-x64

10

5099585c34...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5099585c343b0b769fe39cc9f3cf376b_JaffaCakes118

  • Size

    1.6MB

  • Sample

    240729-tbz2wawbkp

  • MD5

    5099585c343b0b769fe39cc9f3cf376b

  • SHA1

    446512300e8e41fe517b68257a0bdae8194caa5f

  • SHA256

    4628c89109f5af8e4e6522f56ddb77abafd801fd38a48d61240987586b4b7dc8

  • SHA512

    5e88617ef9a5ff3134cf5c275bd3778fc38da60c02824c3650139b5344e5dd8668a2ef5475730c0ffe105d9644c03cfe8f0fdd825f977d81719b794a4627dcf9

  • SSDEEP

    24576:S8hijUtoBQWCKo0osWOZTU1te+xUZtuGchLfI8zEd/wP0l:S8hijUmfo1IZTU1c+xUZsHhLg8fY

Score
10/10
massloggercollectioncredential_accessdiscoveryspywarestealer

Malware Config

Targets

    • Target

      5099585c343b0b769fe39cc9f3cf376b_JaffaCakes118

    • Size

      1.6MB

    • MD5

      5099585c343b0b769fe39cc9f3cf376b

    • SHA1

      446512300e8e41fe517b68257a0bdae8194caa5f

    • SHA256

      4628c89109f5af8e4e6522f56ddb77abafd801fd38a48d61240987586b4b7dc8

    • SHA512

      5e88617ef9a5ff3134cf5c275bd3778fc38da60c02824c3650139b5344e5dd8668a2ef5475730c0ffe105d9644c03cfe8f0fdd825f977d81719b794a4627dcf9

    • SSDEEP

      24576:S8hijUtoBQWCKo0osWOZTU1te+xUZtuGchLfI8zEd/wP0l:S8hijUmfo1IZTU1c+xUZsHhLg8fY

    Score
    10/10
    massloggercollectioncredential_accessdiscoveryspywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks