Overview

overview

10

Static

static

3

c0d760b7f0...18.exe

windows7-x64

10

c0d760b7f0...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c0d760b7f07f74a1b37a8724581e7dbd_JaffaCakes118

  • Size

    934KB

  • Sample

    240825-qptkgawgkd

  • MD5

    c0d760b7f07f74a1b37a8724581e7dbd

  • SHA1

    2ba0c0311451646bb478beb97f36d42e65478270

  • SHA256

    41ccbc679c2941a561c736334dd245fdfd0dffef9656a55eede15676a60f55cc

  • SHA512

    5c9311ad10acd2bfafe7a665d3d02bd536d6f982286ed281507c2b502e5aab5580b9a73ff8d60b68b0a10f07e0608536f88c4484e83a3a3b22155ff53bc89d1d

  • SSDEEP

    12288:0M8L5hjv2zv1gIHNlt21k0w8fv479+Z3bK653H94Cw94Hdr6Zye7+1HbltjAyCji:IhK2iE1k0rXYcZ3r3OCwW7v0PR6aSiPg

Score
10/10
massloggercollectioncredential_accessdiscoveryspywarestealer

Malware Config

Targets

    • Target

      c0d760b7f07f74a1b37a8724581e7dbd_JaffaCakes118

    • Size

      934KB

    • MD5

      c0d760b7f07f74a1b37a8724581e7dbd

    • SHA1

      2ba0c0311451646bb478beb97f36d42e65478270

    • SHA256

      41ccbc679c2941a561c736334dd245fdfd0dffef9656a55eede15676a60f55cc

    • SHA512

      5c9311ad10acd2bfafe7a665d3d02bd536d6f982286ed281507c2b502e5aab5580b9a73ff8d60b68b0a10f07e0608536f88c4484e83a3a3b22155ff53bc89d1d

    • SSDEEP

      12288:0M8L5hjv2zv1gIHNlt21k0w8fv479+Z3bK653H94Cw94Hdr6Zye7+1HbltjAyCji:IhK2iE1k0rXYcZ3r3OCwW7v0PR6aSiPg

    Score
    10/10
    massloggercollectioncredential_accessdiscoveryspywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks