General
-
Target
93f5720a9254da4981cc4d1cda042188_JaffaCakes118
-
Size
804KB
-
Sample
240813-vjl1nazgll
-
MD5
93f5720a9254da4981cc4d1cda042188
-
SHA1
d8c7aea4fd6bd8cdf29e6f9434108e97b6b474e8
-
SHA256
78b7888884720043c06b8401c39e36c4b07c287bba5b7faa8904ac859c46da22
-
SHA512
6270f347eaaa7b7d683785049f0fc188ef7423ad1cf8cff0514128cec9f6c1c3c8c82b4b8eb2abb43e2c7838e1d8ba1c535fcd985ef93370547b030c5ab0159e
-
SSDEEP
24576:tlWO2agwEklViekhWlc5S7QAvO6rbLyir:tlWjaVEAVi3K7a6rbTr
Static task
static1
Behavioral task
behavioral1
Sample
93f5720a9254da4981cc4d1cda042188_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
93f5720a9254da4981cc4d1cda042188_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
matiex
Protocol: smtp- Host:
ebop.website - Port:
587 - Username:
[email protected] - Password:
P@ssw0rdP@ssw0rd
Targets
-
-
Target
93f5720a9254da4981cc4d1cda042188_JaffaCakes118
-
Size
804KB
-
MD5
93f5720a9254da4981cc4d1cda042188
-
SHA1
d8c7aea4fd6bd8cdf29e6f9434108e97b6b474e8
-
SHA256
78b7888884720043c06b8401c39e36c4b07c287bba5b7faa8904ac859c46da22
-
SHA512
6270f347eaaa7b7d683785049f0fc188ef7423ad1cf8cff0514128cec9f6c1c3c8c82b4b8eb2abb43e2c7838e1d8ba1c535fcd985ef93370547b030c5ab0159e
-
SSDEEP
24576:tlWO2agwEklViekhWlc5S7QAvO6rbLyir:tlWjaVEAVi3K7a6rbTr
-
Matiex Main payload
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-