Overview

overview

10

Static

static

3

91517fab79...18.exe

windows7-x64

10

91517fab79...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    91517fab796b1b5de1dd6a92da6becd5_JaffaCakes118

  • Size

    840KB

  • Sample

    240813-dbh6cszhnc

  • MD5

    91517fab796b1b5de1dd6a92da6becd5

  • SHA1

    f8bd5fb8cae533a3abe977b8febe561b7302f19c

  • SHA256

    4d6b9805be6686ee8a01a91f2e8b949b0aeebd7dcd4ef555cd84e0eb8accc678

  • SHA512

    9c0aed4ca13660066cb31a9595306ce655db3945a1ab1da50b7f7bde8d8cd8b0121e35c65462def8ad3510b6cfdfe4a7eae3a7c3c975fcb0df8a95e195803c5b

  • SSDEEP

    12288:ZeTBPJWmK0FJFAB2+8q7S1iJ2QsWreSuNc8R+Teg6Crv6IxIvhHHFy:ZelLGZ8twIQLreSK1R+Z68yUY98

Score
10/10
massloggercollectioncredential_accessdiscoveryspywarestealer

Malware Config

Targets

    • Target

      91517fab796b1b5de1dd6a92da6becd5_JaffaCakes118

    • Size

      840KB

    • MD5

      91517fab796b1b5de1dd6a92da6becd5

    • SHA1

      f8bd5fb8cae533a3abe977b8febe561b7302f19c

    • SHA256

      4d6b9805be6686ee8a01a91f2e8b949b0aeebd7dcd4ef555cd84e0eb8accc678

    • SHA512

      9c0aed4ca13660066cb31a9595306ce655db3945a1ab1da50b7f7bde8d8cd8b0121e35c65462def8ad3510b6cfdfe4a7eae3a7c3c975fcb0df8a95e195803c5b

    • SSDEEP

      12288:ZeTBPJWmK0FJFAB2+8q7S1iJ2QsWreSuNc8R+Teg6Crv6IxIvhHHFy:ZelLGZ8twIQLreSK1R+Z68yUY98

    Score
    10/10
    massloggercollectioncredential_accessdiscoveryspywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks