Overview

overview

10

Static

static

1

specifikac...PDF.js

windows7-x64

10

specifikac...PDF.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b536076321a4a195d9447ba745e66d67_JaffaCakes118

  • Size

    1KB

  • Sample

    240821-1xagnssgqf

  • MD5

    b536076321a4a195d9447ba745e66d67

  • SHA1

    7e784e0379eb69b2f8c0e6d41e1aa55de5aad67c

  • SHA256

    0ead6b8694a19c0d326a98c14c0b8ec51abbac371464679aa1c9f5b85e0433b2

  • SHA512

    5aee9b115a24b042bf6fb1c7f4ec2d5174c2cf1d16592c2cec5f3cdf028eab037b933308245357091bbdd0220cd7042d32d7e367131c56b8271cdf90dd961a72

Score
10/10
massloggercollectioncredential_accessdiscoveryexecutionspywarestealer

Malware Config

Targets

    • Target

      specifikace_projektu_doc04361120200924113759_ACF.28668_DPJ2020012681085.PDF.js

    • Size

      3KB

    • MD5

      ea79f170b2f7531f6aae0190cfac32d3

    • SHA1

      06a49ce472f34b717e2ef5ea2fe758b36bbeaf8a

    • SHA256

      8f0a1868051989d74f2a968a6f326c7ad3c442b4d1b90933a93e3851bebc26a4

    • SHA512

      9a79ca5c74671dca4fdf607fdbd67b1f42afac4239f5de83499cb8e70fd971a9a4c976599baeebb3e060f31229021d6f9110693ed0fd8d6237b2d4eedca94b4b

    Score
    10/10
    executionmassloggercollectioncredential_accessdiscoveryspywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main payload

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Blocklisted process makes network request

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks