83d83a164729291cd2c52760020e5a09581a4647edfd13b415ac5de2012bf63d | Triage

Sharing

General

Target

a2c342a3c7cd5f99649c919f85520349_JaffaCakes118
Size

19KB
Sample

240817-q1g1taybpb
MD5

a2c342a3c7cd5f99649c919f85520349
SHA1

5d807062c879efaf5fff3b94a43432b88641656a
SHA256

83d83a164729291cd2c52760020e5a09581a4647edfd13b415ac5de2012bf63d
SHA512

6f294668e724c8cab91389792355dacce2941242419251f68b226793f0d147c3b72160726784aebc1142231f8f4fc5bd25dc9ce25a856c923d7e1bd2a6ac962e
SSDEEP

384:eJ6rZ7aV7FNp9PxZInfyvqYPZviUVWNeQoxJOxNRw8quC:S6rU77zInKfPp5Q0JOBRC

Score

10^/10

discovery evasion execution spyware stealer upx

Malware Config

Targets

- Target
  
  a2c342a3c7cd5f99649c919f85520349_JaffaCakes118
- Size
  
  19KB
- MD5
  
  a2c342a3c7cd5f99649c919f85520349
- SHA1
  
  5d807062c879efaf5fff3b94a43432b88641656a
- SHA256
  
  83d83a164729291cd2c52760020e5a09581a4647edfd13b415ac5de2012bf63d
- SHA512
  
  6f294668e724c8cab91389792355dacce2941242419251f68b226793f0d147c3b72160726784aebc1142231f8f4fc5bd25dc9ce25a856c923d7e1bd2a6ac962e
- SSDEEP
  
  384:eJ6rZ7aV7FNp9PxZInfyvqYPZviUVWNeQoxJOxNRw8quC:S6rU77zInKfPp5Q0JOBRC
Score

10^/10

discovery evasion execution spyware stealer upx
- Disables service(s)
  evasion execution
- Stops running service(s)
  evasion execution
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

discoveryevasionexecutionspywarestealerupx

behavioral2

discoveryevasionexecutionspywarestealerupx