Overview

overview

10

Static

static

3

960ee162a6...18.exe

windows7-x64

10

960ee162a6...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    960ee162a6cb8b6d12a16e6b4e3875ca_JaffaCakes118

  • Size

    888KB

  • Sample

    240814-penqsswelk

  • MD5

    960ee162a6cb8b6d12a16e6b4e3875ca

  • SHA1

    0ba03272a699622db4e7101555cab77b73b0c2f0

  • SHA256

    3fcfc9d3ddc98387b890322bf04ac34ff8059831e569eb0238d3dc7a81406e06

  • SHA512

    730521d4f5b6fac0a59e1382290fc0cc59d76dbd7cd18cc9c5a94bbc24c0e4264d53f12b34a02078bfb2745824a8a65849ca552e75481cfd4c47946be95438dd

  • SSDEEP

    24576:P2v1F1rxH3E37XxiyN+DCrbx/Nl/e0DWa/esPtt4:+vTZxXEjxEgx/Nl/eW7GsPtt

Score
10/10
massloggercollectioncredential_accessdiscoveryspywarestealer

Malware Config

Targets

    • Target

      960ee162a6cb8b6d12a16e6b4e3875ca_JaffaCakes118

    • Size

      888KB

    • MD5

      960ee162a6cb8b6d12a16e6b4e3875ca

    • SHA1

      0ba03272a699622db4e7101555cab77b73b0c2f0

    • SHA256

      3fcfc9d3ddc98387b890322bf04ac34ff8059831e569eb0238d3dc7a81406e06

    • SHA512

      730521d4f5b6fac0a59e1382290fc0cc59d76dbd7cd18cc9c5a94bbc24c0e4264d53f12b34a02078bfb2745824a8a65849ca552e75481cfd4c47946be95438dd

    • SSDEEP

      24576:P2v1F1rxH3E37XxiyN+DCrbx/Nl/e0DWa/esPtt4:+vTZxXEjxEgx/Nl/eW7GsPtt

    Score
    10/10
    massloggercollectioncredential_accessdiscoveryspywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks