Overview

overview

7

Static

static

3

89ba0f86a1...18.exe

windows7-x64

7

89ba0f86a1...18.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    89ba0f86a10e5dc200c62db66c785a0f_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240811-kn2xkawgqc

  • MD5

    89ba0f86a10e5dc200c62db66c785a0f

  • SHA1

    c05d33ad7fd913d8a233a503e4f49bae208682e6

  • SHA256

    206d1901798764e8f4727cce3011edc6b78624a8016bce49f5be9478978c8d4f

  • SHA512

    7ebef3abe8cfbadbae1c2baf95b87505835ff6d3df8a9734ad805fa12fd567e70d19baea911737a9546ca7f2763d8e330afecd9631018ef941121a734bf7ef1b

  • SSDEEP

    24576:Fo2AV8CrdZ/MO0NvNA2hEVagS6Zk6OPctZTZ/RIh9clboNDx8VwTyY/ouenFKrfR:EvF3kF

Score
7/10
credential_accessdiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      89ba0f86a10e5dc200c62db66c785a0f_JaffaCakes118

    • Size

      1.1MB

    • MD5

      89ba0f86a10e5dc200c62db66c785a0f

    • SHA1

      c05d33ad7fd913d8a233a503e4f49bae208682e6

    • SHA256

      206d1901798764e8f4727cce3011edc6b78624a8016bce49f5be9478978c8d4f

    • SHA512

      7ebef3abe8cfbadbae1c2baf95b87505835ff6d3df8a9734ad805fa12fd567e70d19baea911737a9546ca7f2763d8e330afecd9631018ef941121a734bf7ef1b

    • SSDEEP

      24576:Fo2AV8CrdZ/MO0NvNA2hEVagS6Zk6OPctZTZ/RIh9clboNDx8VwTyY/ouenFKrfR:EvF3kF

    Score
    7/10
    credential_accessdiscoverypersistencespywarestealer

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks