0bc6942798850a75b700811bf7d562cc2558243f48eab00509cb2f494d350d81 | Triage

Sharing

General

Target

82d6a5660be10da7954b05e824122d4a_JaffaCakes118
Size

49KB
Sample

240802-ds3w4axfje
MD5

82d6a5660be10da7954b05e824122d4a
SHA1

29beedbfeb2c21f8e42bf295128a09dfbc312bde
SHA256

0bc6942798850a75b700811bf7d562cc2558243f48eab00509cb2f494d350d81
SHA512

8b0edb7e7ad1e620e883ada1443e2c776d67c29a3faf5b90dd4a8887a55a32cfdec3a372b372a34f1842f3f2be923d8dd12f970081da7a2fe291ae282ec4bb2f
SSDEEP

768:S++vPAmzsKZyQnkCfXLfkRcaDruhIB0EYMyL7lzZsOAjSWHEiIJWFSaPMQF:S/gGZyEDkn/ucPu7lNsPuliRwa08

Score

10^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  82d6a5660be10da7954b05e824122d4a_JaffaCakes118
- Size
  
  49KB
- MD5
  
  82d6a5660be10da7954b05e824122d4a
- SHA1
  
  29beedbfeb2c21f8e42bf295128a09dfbc312bde
- SHA256
  
  0bc6942798850a75b700811bf7d562cc2558243f48eab00509cb2f494d350d81
- SHA512
  
  8b0edb7e7ad1e620e883ada1443e2c776d67c29a3faf5b90dd4a8887a55a32cfdec3a372b372a34f1842f3f2be923d8dd12f970081da7a2fe291ae282ec4bb2f
- SSDEEP
  
  768:S++vPAmzsKZyQnkCfXLfkRcaDruhIB0EYMyL7lzZsOAjSWHEiIJWFSaPMQF:S/gGZyEDkn/ucPu7lNsPuliRwa08
Score

10^/10

discovery persistence spyware stealer
- Modifies WinLogon for persistence
  persistence
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer

behavioral2