5b198bb26a6f72a8bf0eb79adfb52707ab3b486565a02ddf186a57d7df1896c1 | Triage

Sharing

General

Target

a1053ae11c9858117898476472227f54_JaffaCakes118
Size

517KB
Sample

240817-dxl45svblg
MD5

a1053ae11c9858117898476472227f54
SHA1

df3c284fd1598f3ac32e8bebf3e8f1f23c1a87bb
SHA256

5b198bb26a6f72a8bf0eb79adfb52707ab3b486565a02ddf186a57d7df1896c1
SHA512

ccd20a16fecc81cdedf91ed4f18305405713da75fb8e3c7504d6a07904603f4b1019d89bf771b17e1b59ffa0996c030f00f6461ab4168bda717bffefbd217df3
SSDEEP

12288:l1BmdlARDT12oVW0G5NXIhMcVUaAutNjCIvwS4:l1BmdlAlYoI0G5NYhMFkDFt4

Score

7^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  a1053ae11c9858117898476472227f54_JaffaCakes118
- Size
  
  517KB
- MD5
  
  a1053ae11c9858117898476472227f54
- SHA1
  
  df3c284fd1598f3ac32e8bebf3e8f1f23c1a87bb
- SHA256
  
  5b198bb26a6f72a8bf0eb79adfb52707ab3b486565a02ddf186a57d7df1896c1
- SHA512
  
  ccd20a16fecc81cdedf91ed4f18305405713da75fb8e3c7504d6a07904603f4b1019d89bf771b17e1b59ffa0996c030f00f6461ab4168bda717bffefbd217df3
- SSDEEP
  
  12288:l1BmdlARDT12oVW0G5NXIhMcVUaAutNjCIvwS4:l1BmdlAlYoI0G5NYhMFkDFt4
Score

7^/10

discovery
- Loads dropped DLL
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/InstallOptions.dll
- Size
  
  14KB
- MD5
  
  325b008aec81e5aaa57096f05d4212b5
- SHA1
  
  27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA256
  
  c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- SHA512
  
  18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP
  
  192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/NSISdl.dll
- Size
  
  14KB
- MD5
  
  a5f8399a743ab7f9c88c645c35b1ebb5
- SHA1
  
  168f3c158913b0367bf79fa413357fbe97018191
- SHA256
  
  dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
- SHA512
  
  824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
- SSDEEP
  
  192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  c17103ae9072a06da581dec998343fc1
- SHA1
  
  b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA256
  
  dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- SHA512
  
  d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP
  
  192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/inetc.dll
- Size
  
  20KB
- MD5
  
  7569b23f19a0f5cb4c1d3b30a296c4bb
- SHA1
  
  c5f3546b3c795e46445393960694a2341692ddc7
- SHA256
  
  615bf32e15aaa8d58832df2298f75dd2b29ea5f25bf152c99630315cb618a31a
- SHA512
  
  11663bf180f9540ad247957b6793f8afd1b4e66f3b692b4ad05735f07459dd524571245928c40e26e3de691472508f5632fcd4add1eebad559d504eca32c08a9
- SSDEEP
  
  384:gBCwUYeQ8geEQyhUtXlcgCHe8DSMk8/UhU7ya4Lp0Ac9khYLMkIX0+GvRgbJ1:pwUEpet1cgCHe8DNN/UhUua4L
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/nsDialogs.dll
- Size
  
  9KB
- MD5
  
  c10e04dd4ad4277d5adc951bb331c777
- SHA1
  
  b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
- SHA256
  
  e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
- SHA512
  
  853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
- SSDEEP
  
  96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  
  Extras/setup.exe
- Size
  
  446KB
- MD5
  
  9878df8b331662a54373bd536d50f9de
- SHA1
  
  001f18b67a77d5a20971e407f000b1e67f231e01
- SHA256
  
  14ff5c8bd910abeb08d04a84d546fc87697ad948d770ab0b85b0c5111fed72f2
- SHA512
  
  d8085c292a5a99a3576973de10c44dc8fd822756a47e4091b24e56a34942ca99b34a0d56f9e9b565bcde1250493ac0d322c11c9fc9e29364b4809c05895feb6e
- SSDEEP
  
  12288:TXx0fgMd/+ealb2yzZS52HYX9Qil52wKuANHnZAv:TCpsb2yzZS52S352DT5nZAv
Score

7^/10

discovery spyware stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral13 behavioral14
- Target
  
  $PLUGINSDIR/CustomLicense.dll
- Size
  
  3KB
- MD5
  
  3c4c9b038c7eb5223691586a42415fef
- SHA1
  
  53eb3587f5313f9aae5aea8b92f7ceb45db19fc6
- SHA256
  
  60f9263a1693ae5a18523ee5d0f37e512882edaea2b84a028279d7fe5bb305ae
- SHA512
  
  a07843d793811ca6ea9be734c458209a1bb224297743e23304f48b65f38ea9ae5a570f99b5c23642431ecb5cb30bcb43848bb92e6529395c232c63f641143250
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  
  $PLUGINSDIR/GetVersion.dll
- Size
  
  6KB
- MD5
  
  5264f7d6d89d1dc04955cfb391798446
- SHA1
  
  211d8d3e7c2b2f57f54a11cb8bc4fa536df08acc
- SHA256
  
  7d76c7dd8f7cd5a87e0118dacb434db3971a049501e22a5f4b947154621ab3d4
- SHA512
  
  80d27ee2f87e2822bd5c8c55cc3d1e49beebb86d8557c92b52b7cbea9f27882d80e59eefa25e414eecee268a9a6193b6b50b748de33c778b007cde24ef8bcfb7
- SSDEEP
  
  96:E12Z84uiwpGTVTDSpaHYfniz0R3GhCvXY6Ix5vdR7pBi46AQ5Vu4:2STVTGwYhR3GhCvy5vH7pBi46AQ5Vu
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  
  $PLUGINSDIR/KillProcDLL.dll
- Size
  
  4KB
- MD5
  
  99f345cf51b6c3c317d20a81acb11012
- SHA1
  
  b3d0355f527c536ea14a8ff51741c8739d66f727
- SHA256
  
  c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
- SHA512
  
  937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  
  $PLUGINSDIR/Math.dll
- Size
  
  66KB
- MD5
  
  b140459077c7c39be4bef249c2f84535
- SHA1
  
  c56498241c2ddafb01961596da16d08d1b11cd35
- SHA256
  
  0598f7d83db44929b7170c1285457b52b4281185f63ced102e709bf065f10d67
- SHA512
  
  fbcb19a951d96a216d73b6b3e005338bbb6e11332c6cc8c3f179ccd420b4db0e5682dc4245bd120dcb67bc70960eab368e74c68c7c165a485a12a7d0d8a00328
- SSDEEP
  
  1536:0P43WZ4Ql60gam+2MwRmPeqFVHbQH0ZZ1Iet:0wU609VMH0T/t
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  
  $PLUGINSDIR/NSISdl.dll
- Size
  
  14KB
- MD5
  
  a5f8399a743ab7f9c88c645c35b1ebb5
- SHA1
  
  168f3c158913b0367bf79fa413357fbe97018191
- SHA256
  
  dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
- SHA512
  
  824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
- SSDEEP
  
  192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  c17103ae9072a06da581dec998343fc1
- SHA1
  
  b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA256
  
  dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- SHA512
  
  d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP
  
  192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  
  $PLUGINSDIR/inetc.dll
- Size
  
  20KB
- MD5
  
  2f94245152dbd233e248909f9c01c578
- SHA1
  
  ab4e5879c001b36a2f9ff214946599fd015edda9
- SHA256
  
  4c4d85eb9725fc7fade03467990e3dd9671c29a7870c97e69babc2cb3c9adef9
- SHA512
  
  f92830de27d6663be5e0df9e32cd88732bc7ee93b14c1ded65258c325d22436400801aff1124f40400c6c3b3c16e71deb08436714716f3888d13a8a6b6a32231
- SSDEEP
  
  384:vBCwUYeQ8geEQyhUtXlcgCHe8DSMk8/UhU7ya4L+0Ac9khYLMkIX0+GvRgbJ1:owUEpet1cgCHe8DNN/UhUua4L
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  
  $PLUGINSDIR/linker.dll
- Size
  
  6KB
- MD5
  
  8450b29ee8d592c208ba1aaf6ee50267
- SHA1
  
  75096da057bc85cef63bb0eec168652ea75cf618
- SHA256
  
  53aa57e582dc56421c1191a0a9efac9c36960b903b7d825f3b9682605ec2b612
- SHA512
  
  d23a3057053a1f36f5eb212ae0b09b9b0b41e50b8a6a20bbc46c12c51199ad0bca741bcce17534488158e8f2b9470dbdac2aa059688b7588a05778c40d461039
- SSDEEP
  
  48:q/XgJspkvsIWyuS3fyVLkmqbIWXGuDNcGo+FLtLFSfrPIk2vIhll:4gJsFIWjS3qVomqIixo+9tLFUr4vMl
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  
  $PLUGINSDIR/md5dll.dll
- Size
  
  8KB
- MD5
  
  a7d710e78711d5ab90e4792763241754
- SHA1
  
  f31cecd926c5d497aba163a17b75975ec34beb13
- SHA256
  
  9b05dd603f13c196f3f21c43f48834208fed2294f7090fcd1334931014611fb2
- SHA512
  
  f0ca2d6f9a8aeac84ef8b051154a041adffc46e3e9aced142e9c7bf5f7272b047e1db421d38cb2d9182d7442bee3dd806618b019ec042a23ae0e71671d2943c0
- SSDEEP
  
  96:YV2qpbvYSflug0Dvxn6GuKM9sh1gdrN9+oB7FT9WibOoBZcko5N/:Yt5lugRK8hlvbwkKV
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

discoveryspywarestealer

behavioral14

discoveryspywarestealer

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32