67ac7ffcf5a7542c918289dc26098c6159feb851bd8aa88d8b9341ef7795ffa7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8509d2c34e58daf29a78734c9d591430_JaffaCakes118
Size

487KB
Sample

240810-gsw1bsyckr
MD5

8509d2c34e58daf29a78734c9d591430
SHA1

c2a283eba2579055828850030a7846ff1f55d693
SHA256

67ac7ffcf5a7542c918289dc26098c6159feb851bd8aa88d8b9341ef7795ffa7
SHA512

d9fbca6c9f671700b95d1d78f23dfb6ce6f06ad916e51010d1ae563d3ff6c10b689c592f765887878d345de15f8f15911110323ff0c3d2826a19ba179226a40e
SSDEEP

12288:0WbtGfzu/rBn6nkn3xZkk2t9bK9R3ca0wX:zSzorpGA3xT+SbHX

Score

9^/10

discovery evasion spyware stealer upx

Malware Config

Targets

- Target
  
  8509d2c34e58daf29a78734c9d591430_JaffaCakes118
- Size
  
  487KB
- MD5
  
  8509d2c34e58daf29a78734c9d591430
- SHA1
  
  c2a283eba2579055828850030a7846ff1f55d693
- SHA256
  
  67ac7ffcf5a7542c918289dc26098c6159feb851bd8aa88d8b9341ef7795ffa7
- SHA512
  
  d9fbca6c9f671700b95d1d78f23dfb6ce6f06ad916e51010d1ae563d3ff6c10b689c592f765887878d345de15f8f15911110323ff0c3d2826a19ba179226a40e
- SSDEEP
  
  12288:0WbtGfzu/rBn6nkn3xZkk2t9bK9R3ca0wX:zSzorpGA3xT+SbHX
Score

9^/10

discovery evasion upx spyware stealer
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Enumerates VirtualBox registry keys
  evasion
- Drops file in Drivers directory
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

Software Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionupx

behavioral2

discoveryevasionspywarestealerupx