69bd063c603d2c821f7161186c5a4e803801b054922ef25ca7005858f2ee19a2 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

adbca522c7563eb88648c4de51446bf0_JaffaCakes118
Size

762KB
Sample

240820-d7mteswajn
MD5

adbca522c7563eb88648c4de51446bf0
SHA1

8fb09ab7a5cb8c20137718352ef68391507970da
SHA256

69bd063c603d2c821f7161186c5a4e803801b054922ef25ca7005858f2ee19a2
SHA512

e905e8d0298eb5f81a382faa671589a0ff000cbf7a43fe8dabfbd3e6e461ef88f835003f35a40081e693f090a6eba81cf4aa946caf313070f50722df7d9feb16
SSDEEP

12288:sNe+QHANJC6CwMcuLg0uWSFf51HbcrUVRvFaWmbuM7i/8f7+:sNejaCHceLuppcrYFxiz

Score

7^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  adbca522c7563eb88648c4de51446bf0_JaffaCakes118
- Size
  
  762KB
- MD5
  
  adbca522c7563eb88648c4de51446bf0
- SHA1
  
  8fb09ab7a5cb8c20137718352ef68391507970da
- SHA256
  
  69bd063c603d2c821f7161186c5a4e803801b054922ef25ca7005858f2ee19a2
- SHA512
  
  e905e8d0298eb5f81a382faa671589a0ff000cbf7a43fe8dabfbd3e6e461ef88f835003f35a40081e693f090a6eba81cf4aa946caf313070f50722df7d9feb16
- SSDEEP
  
  12288:sNe+QHANJC6CwMcuLg0uWSFf51HbcrUVRvFaWmbuM7i/8f7+:sNejaCHceLuppcrYFxiz
Score

7^/10

discovery spyware stealer
- Drops startup file
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials in Registry

Discovery

Query Registry

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoveryspywarestealer