d86923504cf20d32c7cb99490c3b37000777d71f932f685f6be22e4bbafbf857 | Triage

Sharing

General

Target

e1e788e36729db3bd1c754a160340021_JaffaCakes118
Size

85KB
Sample

240915-hd2gyazgng
MD5

e1e788e36729db3bd1c754a160340021
SHA1

fbf1072e91554603dbf86599ad2571a513b2c6db
SHA256

d86923504cf20d32c7cb99490c3b37000777d71f932f685f6be22e4bbafbf857
SHA512

7a442471d5d5451f2fb6005ae368bb6eba299b73dd37711b4136049fc53c067786b4cbe2a038a76a5458d068508dc2c34c3b14e106940e6f718a2f60a61f7535
SSDEEP

1536:bWmBAmo4YsUvAMbRxQx+3KuKkcUoTfTH+k6dwymR:bHoOUvAMbRNKEo3HnpD

Score

8^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  e1e788e36729db3bd1c754a160340021_JaffaCakes118
- Size
  
  85KB
- MD5
  
  e1e788e36729db3bd1c754a160340021
- SHA1
  
  fbf1072e91554603dbf86599ad2571a513b2c6db
- SHA256
  
  d86923504cf20d32c7cb99490c3b37000777d71f932f685f6be22e4bbafbf857
- SHA512
  
  7a442471d5d5451f2fb6005ae368bb6eba299b73dd37711b4136049fc53c067786b4cbe2a038a76a5458d068508dc2c34c3b14e106940e6f718a2f60a61f7535
- SSDEEP
  
  1536:bWmBAmo4YsUvAMbRxQx+3KuKkcUoTfTH+k6dwymR:bHoOUvAMbRNKEo3HnpD
Score

8^/10

discovery spyware stealer
- Downloads MZ/PE file
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer