Overview

overview

10

Static

static

3

9819aa4a5a...18.exe

windows7-x64

10

9819aa4a5a...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9819aa4a5a3ac2bc168c60bab29b6874_JaffaCakes118

  • Size

    843KB

  • Sample

    240814-3grgcswhqq

  • MD5

    9819aa4a5a3ac2bc168c60bab29b6874

  • SHA1

    e744481c34c5792b6199821f50da13a2c375c719

  • SHA256

    ee880952ee58fc84d182465b247a4b01e876ff1186cc4ae16ffb94ef44b45700

  • SHA512

    bad084ec2d9bd6aa474ec53b027a2290c5ee781adca74924f2f3f8b7c3c862dae7d86b04876890292659765d3af7bfdebe02f101adb83ab542e6305cbdc69649

  • SSDEEP

    24576:dUMTlbfO1RIv9SwceTkTu5JUHDsJmWUcRc:dzlbO1RIVcGt5JUDc

Score
10/10
massloggercollectioncredential_accessdiscoveryspywarestealer

Malware Config

Targets

    • Target

      9819aa4a5a3ac2bc168c60bab29b6874_JaffaCakes118

    • Size

      843KB

    • MD5

      9819aa4a5a3ac2bc168c60bab29b6874

    • SHA1

      e744481c34c5792b6199821f50da13a2c375c719

    • SHA256

      ee880952ee58fc84d182465b247a4b01e876ff1186cc4ae16ffb94ef44b45700

    • SHA512

      bad084ec2d9bd6aa474ec53b027a2290c5ee781adca74924f2f3f8b7c3c862dae7d86b04876890292659765d3af7bfdebe02f101adb83ab542e6305cbdc69649

    • SSDEEP

      24576:dUMTlbfO1RIv9SwceTkTu5JUHDsJmWUcRc:dzlbO1RIVcGt5JUDc

    Score
    10/10
    massloggercollectioncredential_accessdiscoveryspywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks