6524b32495882416735df442b8d9cebf4b8f3f2f5f6d4bc2f5d3d2c0f985e41d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d103896bf6825b38cd027daead91e863_JaffaCakes118
Size

372KB
Sample

240907-eflbysteqb
MD5

d103896bf6825b38cd027daead91e863
SHA1

9c40dad7fcf28ebec9064a335b3b4a15a20e6f44
SHA256

6524b32495882416735df442b8d9cebf4b8f3f2f5f6d4bc2f5d3d2c0f985e41d
SHA512

6e661f53d3b66308fa8e2e7e3d7c3289e8fe17d028b8cf46334999078cd93a729a5dd2da324077ee4462a84ff21b578e49721dc0bb734cebea4d85a5ebaa5a1b
SSDEEP

6144:V29fpVL01b4b7tw1fdJzIJz6eS+5MR98Mgds7HiTddQv2X2Gh:Vmf/o1UXq1fPsJBS+MReM4ZdMah

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  d103896bf6825b38cd027daead91e863_JaffaCakes118
- Size
  
  372KB
- MD5
  
  d103896bf6825b38cd027daead91e863
- SHA1
  
  9c40dad7fcf28ebec9064a335b3b4a15a20e6f44
- SHA256
  
  6524b32495882416735df442b8d9cebf4b8f3f2f5f6d4bc2f5d3d2c0f985e41d
- SHA512
  
  6e661f53d3b66308fa8e2e7e3d7c3289e8fe17d028b8cf46334999078cd93a729a5dd2da324077ee4462a84ff21b578e49721dc0bb734cebea4d85a5ebaa5a1b
- SSDEEP
  
  6144:V29fpVL01b4b7tw1fdJzIJz6eS+5MR98Mgds7HiTddQv2X2Gh:Vmf/o1UXq1fPsJBS+MReM4ZdMah
Score

7^/10

discovery spyware stealer persistence
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoverypersistencespywarestealer