Overview

overview

10

Static

static

1

df8d2bf603...18.exe

windows7-x64

10

df8d2bf603...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    df8d2bf603a5597433e8cfd62dbe7593_JaffaCakes118

  • Size

    5.0MB

  • Sample

    240914-fvblqsydlh

  • MD5

    df8d2bf603a5597433e8cfd62dbe7593

  • SHA1

    9ba9af56b79830af9d099800762ac9ae69fdb7d8

  • SHA256

    9d8e8fe97d70415787127052d57f80f922230d8f45efc168a5125304ef875d66

  • SHA512

    5c1c612dc3449c1f177d91f7de0e8963a4d31e5d35ef567f205cfbd8b52c293304093b6657672787a2156bee75cee3608d016e781a4a11383961f85e2c571d1a

  • SSDEEP

    98304:fBioZ7jsAmDYzf8frxWjs6rWvPBC774rHKzqesTkdGn640UinsdIwFv:fBNjsjDSf84I60C776HKzCj6qisdbv

Score
10/10
pandastealershurkcredential_accessdiscoveryinfostealerspywarestealer

Malware Config

Targets

    • Target

      df8d2bf603a5597433e8cfd62dbe7593_JaffaCakes118

    • Size

      5.0MB

    • MD5

      df8d2bf603a5597433e8cfd62dbe7593

    • SHA1

      9ba9af56b79830af9d099800762ac9ae69fdb7d8

    • SHA256

      9d8e8fe97d70415787127052d57f80f922230d8f45efc168a5125304ef875d66

    • SHA512

      5c1c612dc3449c1f177d91f7de0e8963a4d31e5d35ef567f205cfbd8b52c293304093b6657672787a2156bee75cee3608d016e781a4a11383961f85e2c571d1a

    • SSDEEP

      98304:fBioZ7jsAmDYzf8frxWjs6rWvPBC774rHKzqesTkdGn640UinsdIwFv:fBNjsjDSf84I60C776HKzCj6qisdbv

    Score
    10/10
    pandastealershurkcredential_accessdiscoveryinfostealerspywarestealer

    • Panda Stealer payload

    • PandaStealer

      Panda Stealer is a fork of CollectorProject Stealer written in C++.

      stealerpandastealer

    • Shurk

      Shurk is an infostealer, written in C++ which appeared in 2021.

      infostealershurk

    • Shurk Stealer payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks