General

  • Target

    b26e7ab91c4fd23f5c33de4ccf41bfcf_JaffaCakes118

  • Size

    160KB

  • Sample

    240821-hbtpbatgnf

  • MD5

    b26e7ab91c4fd23f5c33de4ccf41bfcf

  • SHA1

    0417ea540acfec0c0bd1f77567bf37fa01aafec6

  • SHA256

    fa68256ace5df1dc32c77c184fbb23e0ade89befe65435325a397f8695c6d57a

  • SHA512

    f8089e1fa0f5e901a4c62b562b0fbd52981c8d97cc145b32cf5068b1de8b774fc9213977254fcb186a9fc232d3a50d60cb5628c77058b3f60f17d3651a7a7b53

  • SSDEEP

    3072:HJJDSWmoF7b7NGWEDgJvhQQC92LPmWZWG7+198bV9lBBude:H3xFf7NGYuQOCj7+1ebVXz1

Malware Config

Targets

    • Target

      b26e7ab91c4fd23f5c33de4ccf41bfcf_JaffaCakes118

    • Size

      160KB

    • MD5

      b26e7ab91c4fd23f5c33de4ccf41bfcf

    • SHA1

      0417ea540acfec0c0bd1f77567bf37fa01aafec6

    • SHA256

      fa68256ace5df1dc32c77c184fbb23e0ade89befe65435325a397f8695c6d57a

    • SHA512

      f8089e1fa0f5e901a4c62b562b0fbd52981c8d97cc145b32cf5068b1de8b774fc9213977254fcb186a9fc232d3a50d60cb5628c77058b3f60f17d3651a7a7b53

    • SSDEEP

      3072:HJJDSWmoF7b7NGWEDgJvhQQC92LPmWZWG7+198bV9lBBude:H3xFf7NGYuQOCj7+1ebVXz1

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks