473ef5c9b89f965ebd414e35fbc2265f4f0ca58aa7cfb7444aff83478d28729e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d22eaa0eb4e428c4ce5a16c2e8d7a90c_JaffaCakes118
Size

23KB
Sample

240907-r6jl9s1dlh
MD5

d22eaa0eb4e428c4ce5a16c2e8d7a90c
SHA1

cbd6e61399b8d6890ff10ec2fdc0b9e2d68e4d91
SHA256

473ef5c9b89f965ebd414e35fbc2265f4f0ca58aa7cfb7444aff83478d28729e
SHA512

de22fff448df83c6a3a5c3addc99ad46c4ab4f277dfd86e2c576445f4efd375638a0646d13bfba02b7877af9b63c123b45d8051839f5ff8b261ee28cd09d8e7a
SSDEEP

384:z7x27qOCD29NiaThK31I5dFbnsGildFI8yX16f1zTH1Blkz3:hROCD2hFB5vr8yX16h1

Score

7^/10

credential_access defense_evasion discovery spyware stealer

Malware Config

Targets

- Target
  
  d22eaa0eb4e428c4ce5a16c2e8d7a90c_JaffaCakes118
- Size
  
  23KB
- MD5
  
  d22eaa0eb4e428c4ce5a16c2e8d7a90c
- SHA1
  
  cbd6e61399b8d6890ff10ec2fdc0b9e2d68e4d91
- SHA256
  
  473ef5c9b89f965ebd414e35fbc2265f4f0ca58aa7cfb7444aff83478d28729e
- SHA512
  
  de22fff448df83c6a3a5c3addc99ad46c4ab4f277dfd86e2c576445f4efd375638a0646d13bfba02b7877af9b63c123b45d8051839f5ff8b261ee28cd09d8e7a
- SSDEEP
  
  384:z7x27qOCD29NiaThK31I5dFbnsGildFI8yX16f1zTH1Blkz3:hROCD2hFB5vr8yX16h1
Score

7^/10

credential_access defense_evasion discovery spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

File Deletion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

credential_accessdefense_evasiondiscoveryspywarestealer

behavioral2