General

  • Target

    cf36d5338ec6c2f3c4eca0643600b0f2_JaffaCakes118

  • Size

    1004KB

  • Sample

    240906-lcm5psyclj

  • MD5

    cf36d5338ec6c2f3c4eca0643600b0f2

  • SHA1

    749169f34f30016891cc6a41884d5c2e376ebeef

  • SHA256

    fac6b2bb9719301eba87f49b5131f9b372265e6445f9a4f2d0ccb11b591ef436

  • SHA512

    e532c64d7f98d76280b887d99666368245a43c0fbe64665274c7ac7ab60cb4312c6eecd0aef1c8ac055670caa52f3d874f5eda320fd54db368b21170b85b1a23

  • SSDEEP

    24576:vKlaBa1sMMZvIniOzOhbdCEXBR4UjXuU917ZOBUVOYddp:yfWL2ntzMfXHjXu+HDVOYfp

Malware Config

Targets

    • Target

      cf36d5338ec6c2f3c4eca0643600b0f2_JaffaCakes118

    • Size

      1004KB

    • MD5

      cf36d5338ec6c2f3c4eca0643600b0f2

    • SHA1

      749169f34f30016891cc6a41884d5c2e376ebeef

    • SHA256

      fac6b2bb9719301eba87f49b5131f9b372265e6445f9a4f2d0ccb11b591ef436

    • SHA512

      e532c64d7f98d76280b887d99666368245a43c0fbe64665274c7ac7ab60cb4312c6eecd0aef1c8ac055670caa52f3d874f5eda320fd54db368b21170b85b1a23

    • SSDEEP

      24576:vKlaBa1sMMZvIniOzOhbdCEXBR4UjXuU917ZOBUVOYddp:yfWL2ntzMfXHjXu+HDVOYfp

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger Main payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks