e5cd8df1b4143b5367d9f431ce2850961ad9deaf4c72f569e28e4a11f016affe | Triage

Submit
Reports

Overview

overview

9

Static

static

3

eaa192fa31...18.exe

windows7-x64

9

eaa192fa31...18.exe

windows10-2004-x64

9

Sharing

General

Target

eaa192fa31ff69dcea4105fd15cad0e4_JaffaCakes118
Size

1.4MB
Sample

240919-fm9tkasdkp
MD5

eaa192fa31ff69dcea4105fd15cad0e4
SHA1

f0ff88fa92136731bba5eb45eba233bcd0d3dc6e
SHA256

e5cd8df1b4143b5367d9f431ce2850961ad9deaf4c72f569e28e4a11f016affe
SHA512

3adaf16c2e84f1fcdf39a18c95e8dbd870839fa6f76920ace7d1f0add4a9c0c1bb8cdc5e6cfa35956e45ca5d4fd715e9c65094688b2a7643599c87fc51223162
SSDEEP

12288:4k0RwW0b/uKATTW06MleFxDVH/nw/lG0vbbzP3+Y8a7s1gmOjNqPXMWANsGhOJdL:d2Kdu0H4trhO1grjNqEWAZhOJfAVmaq

Score

9^/10

credential_access discovery persistence spyware stealer upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

eaa192fa31ff69dcea4105fd15cad0e4_JaffaCakes118.exe

Resource

win7-20240903-en

credential_access discovery persistence spyware stealer upx

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

eaa192fa31ff69dcea4105fd15cad0e4_JaffaCakes118.exe

Resource

win10v2004-20240802-en

credential_access discovery persistence spyware stealer upx

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  eaa192fa31ff69dcea4105fd15cad0e4_JaffaCakes118
- Size
  
  1.4MB
- MD5
  
  eaa192fa31ff69dcea4105fd15cad0e4
- SHA1
  
  f0ff88fa92136731bba5eb45eba233bcd0d3dc6e
- SHA256
  
  e5cd8df1b4143b5367d9f431ce2850961ad9deaf4c72f569e28e4a11f016affe
- SHA512
  
  3adaf16c2e84f1fcdf39a18c95e8dbd870839fa6f76920ace7d1f0add4a9c0c1bb8cdc5e6cfa35956e45ca5d4fd715e9c65094688b2a7643599c87fc51223162
- SSDEEP
  
  12288:4k0RwW0b/uKATTW06MleFxDVH/nw/lG0vbbzP3+Y8a7s1gmOjNqPXMWANsGhOJdL:d2Kdu0H4trhO1grjNqEWAZhOJfAVmaq
Score

9^/10

credential_access discovery persistence spyware stealer upx
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

credential_accessdiscoverypersistencespywarestealerupx

behavioral2

credential_accessdiscoverypersistencespywarestealerupx

© 2018-2025

Terms | Privacy