Overview

overview

7

Static

static

3

ac5dfd00ef...18.exe

windows7-x64

3

ac5dfd00ef...18.exe

windows10-2004-x64

3

$PLUGINSDI...es.dll

windows7-x64

3

$PLUGINSDI...es.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$TEMP/CCIS/ccsqlh.exe

windows7-x64

7

$TEMP/CCIS/ccsqlh.exe

windows10-2004-x64

7

$TEMP/CCIS...e3.dll

windows7-x64

3

$TEMP/CCIS...e3.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ac5dfd00efc322e782a4f12027a9f9e5_JaffaCakes118

  • Size

    543KB

  • Sample

    240819-yptjgaxarl

  • MD5

    ac5dfd00efc322e782a4f12027a9f9e5

  • SHA1

    6f2fd5e9ea40254e11df01517eff2d6f29f8ef5e

  • SHA256

    9870a33a44f5279c5c682556c65652783d2f3dbe4e9fbdc9eb2bfb527cac60f2

  • SHA512

    fac6abeda60be59e9a46b2c7cdf6ca42e4fa40c2e7cc91cb198ef1d40de13c58217ef94d640c589af6dcc547b1520ca57842cc0ffba8fae78ffcdd0c1d8182fb

  • SSDEEP

    12288:NhawKk7MaZk0wwwltQXU0PHHL6Ty6XdCniXHP72+T0Zd:NGutctGU+05ko72O+d

Score
7/10
discoveryspywarestealer

Malware Config

Targets

    • Target

      ac5dfd00efc322e782a4f12027a9f9e5_JaffaCakes118

    • Size

      543KB

    • MD5

      ac5dfd00efc322e782a4f12027a9f9e5

    • SHA1

      6f2fd5e9ea40254e11df01517eff2d6f29f8ef5e

    • SHA256

      9870a33a44f5279c5c682556c65652783d2f3dbe4e9fbdc9eb2bfb527cac60f2

    • SHA512

      fac6abeda60be59e9a46b2c7cdf6ca42e4fa40c2e7cc91cb198ef1d40de13c58217ef94d640c589af6dcc547b1520ca57842cc0ffba8fae78ffcdd0c1d8182fb

    • SSDEEP

      12288:NhawKk7MaZk0wwwltQXU0PHHL6Ty6XdCniXHP72+T0Zd:NGutctGU+05ko72O+d

    Score
    3/10
    discovery
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/Processes.dll

    • Size

      58KB

    • MD5

      7a69b2f909c684b261c5e295e95351c6

    • SHA1

      05df8e4e072bd877e5a641608ee35f2cdcf544fb

    • SHA256

      59a81b8119a2e2bc2dcc22d8dbf87b20d6fe8c734930bf86d326cd2708f99358

    • SHA512

      aaccf1bd2254a65c7f8f300fe60b028b95f921d03e6507154d56ad2161dfdda8cd7716d00cff7c4512040bca8610ab7a0684cefec4eb729b98874aa35b5c5a97

    • SSDEEP

      1536:B/JfLQagIhIVkKda2Ido8H667sBy8QQd3n7:dAyoTBTQQN7

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      c17103ae9072a06da581dec998343fc1

    • SHA1

      b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    • SHA256

      dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    • SHA512

      d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/nsExec.dll

    • Size

      6KB

    • MD5

      acc2b699edfea5bf5aae45aba3a41e96

    • SHA1

      d2accf4d494e43ceb2cff69abe4dd17147d29cc2

    • SHA256

      168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

    • SHA512

      e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

    • SSDEEP

      96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $TEMP/CCIS/ccsqlh.exe

    • Size

      623KB

    • MD5

      1d0421a423435d3c4156c26de25e4bbe

    • SHA1

      16f5800582ad6783c14559ac6da82a086b317684

    • SHA256

      47ffb4fe4cd8a3faaf1b7699342be3663ba19a6bbbca1606f248ff736e3e29e4

    • SHA512

      8f3c471004331a31cb6e4b6804ed77a43a98b33185165b1e85a18485be8ae053448323ccffe53ad59504771a067e9dbe55667433ccdbaac19207667eaa2eb69d

    • SSDEEP

      12288:9xFgN1TNk1VB+QshB7GezQwSCj4qaQCIFdYatj+Ek8:fnUQshBGcQwSCNaQ1FdYaVo

    Score
    7/10
    discoveryspywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral10behavioral9

    • Target

      $TEMP/CCIS/sqlite3.dll

    • Size

      545KB

    • MD5

      44b5133750e480e9d4f150261c1ddbb6

    • SHA1

      05c313787f1f08e8150a13bfaa1e4f175d9ab868

    • SHA256

      70fe9a8a9e1b804c8d4029a785d415e2a201df25def8dd4a3da1f85b840aa1a1

    • SHA512

      b14365514a22af8ca304dd9922ed2aa5e93b127cd8f995e02e346266163432caec3938a609eafa734a358a1f77b1d05e3481e93c8bcbd42b1c1ca4a17a96d27c

    • SSDEEP

      6144:BN63gbQWnbVdXvjf2DpuQhXR0ncBah82PqKA6zOOW37GaZ0ojeyYuLbKY42zzUbd:76IH6R0ncNkqKAQt6DBeYBz8V/5

    Score
    3/10
    discovery
    behavioral11behavioral12

MITRE ATT&CK Enterprise v15

Tasks