General

  • Target

    89d91f99c2975f9cdd4ae96baf4760de_JaffaCakes118

  • Size

    68KB

  • Sample

    240811-lft3estekr

  • MD5

    89d91f99c2975f9cdd4ae96baf4760de

  • SHA1

    7348ac95e0eedda67f78cb685144bfd457d6961a

  • SHA256

    f1b4595544078a903afa16d9096915feeda885e5572e785ed415bdbafc7ea30a

  • SHA512

    d391ce2512987c60ef438f55fdee667e5078e9e7a2cda0cb2a8435bbaeaa1f2078b0c862831298247a8b645855425a34a2ebf7532c74266dd4d476de10bc7f71

  • SSDEEP

    1536:s4rOzu7Z1pNfuSvbX11WqTVwvkM0hd7l1Ng3R8tnb:d7eSvbXTL/Xh168nb

Malware Config

Targets

    • Target

      89d91f99c2975f9cdd4ae96baf4760de_JaffaCakes118

    • Size

      68KB

    • MD5

      89d91f99c2975f9cdd4ae96baf4760de

    • SHA1

      7348ac95e0eedda67f78cb685144bfd457d6961a

    • SHA256

      f1b4595544078a903afa16d9096915feeda885e5572e785ed415bdbafc7ea30a

    • SHA512

      d391ce2512987c60ef438f55fdee667e5078e9e7a2cda0cb2a8435bbaeaa1f2078b0c862831298247a8b645855425a34a2ebf7532c74266dd4d476de10bc7f71

    • SSDEEP

      1536:s4rOzu7Z1pNfuSvbX11WqTVwvkM0hd7l1Ng3R8tnb:d7eSvbXTL/Xh168nb

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks