Overview

overview

10

Static

static

3

b62aa82795...18.exe

windows7-x64

10

b62aa82795...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b62aa8279564dcc2ff48fa87d386bafd_JaffaCakes118

  • Size

    201KB

  • Sample

    240822-dyplnawdnd

  • MD5

    b62aa8279564dcc2ff48fa87d386bafd

  • SHA1

    e5960f88c7996157a9891ff46c5bdc4e40083e88

  • SHA256

    1446f60bcbbbd1539d4c542cc327fc35f48208ffc1778a2c60954ac0d2d57b6b

  • SHA512

    2e8361df544ce437509911e0e6cc2f2551e7aceedede0ba89ebe0d629e7ae71428a174c82c6969e398a3bff14f81ccd3e9dc29160ceefdb06a7fd1009a88a71b

  • SSDEEP

    3072:+P9DOGeGl3oOoiAoSJJGaH6HrEyw70BXi8CMOciDteO:bFXiAoSJQPHrU0MLV

Score
10/10
evasionpersistencetrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    thunderlk8

Targets

    • Target

      b62aa8279564dcc2ff48fa87d386bafd_JaffaCakes118

    • Size

      201KB

    • MD5

      b62aa8279564dcc2ff48fa87d386bafd

    • SHA1

      e5960f88c7996157a9891ff46c5bdc4e40083e88

    • SHA256

      1446f60bcbbbd1539d4c542cc327fc35f48208ffc1778a2c60954ac0d2d57b6b

    • SHA512

      2e8361df544ce437509911e0e6cc2f2551e7aceedede0ba89ebe0d629e7ae71428a174c82c6969e398a3bff14f81ccd3e9dc29160ceefdb06a7fd1009a88a71b

    • SSDEEP

      3072:+P9DOGeGl3oOoiAoSJJGaH6HrEyw70BXi8CMOciDteO:bFXiAoSJQPHrU0MLV

    Score
    10/10
    evasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks