470b50bc328ed4fc1a1a0f71178eb731eb5c00efdeeffac5daef4e369f86537a | Triage

Sharing

General

Target

ecea1b9ef4553b388a822cd4634706ed_JaffaCakes118
Size

33KB
Sample

240920-f1gd6szhjd
MD5

ecea1b9ef4553b388a822cd4634706ed
SHA1

527fd2fa760a20a0ebf0beba2dd36f53b54f5ff6
SHA256

470b50bc328ed4fc1a1a0f71178eb731eb5c00efdeeffac5daef4e369f86537a
SHA512

85581d305609ee9c20f6fa3412b9d2dd90f453cc12403fb45482cc8829fe469102c69ec71778585e1257e6be4bf1e28f7e8890a70eac9fa455dc23a3490f8939
SSDEEP

384:96Tp0OfNRSZe+1i3o0UI/BUgInq+AQBOXzn3q+pWNAkSmyb2ss7vYhuwwP8R8ERv:9ax49s40bSBfIzpWN9abK7vahBzHc

Score

10^/10

discovery evasion execution spyware stealer upx

Malware Config

Targets

- Target
  
  ecea1b9ef4553b388a822cd4634706ed_JaffaCakes118
- Size
  
  33KB
- MD5
  
  ecea1b9ef4553b388a822cd4634706ed
- SHA1
  
  527fd2fa760a20a0ebf0beba2dd36f53b54f5ff6
- SHA256
  
  470b50bc328ed4fc1a1a0f71178eb731eb5c00efdeeffac5daef4e369f86537a
- SHA512
  
  85581d305609ee9c20f6fa3412b9d2dd90f453cc12403fb45482cc8829fe469102c69ec71778585e1257e6be4bf1e28f7e8890a70eac9fa455dc23a3490f8939
- SSDEEP
  
  384:96Tp0OfNRSZe+1i3o0UI/BUgInq+AQBOXzn3q+pWNAkSmyb2ss7vYhuwwP8R8ERv:9ax49s40bSBfIzpWN9abK7vahBzHc
Score

10^/10

discovery evasion execution spyware stealer upx
- Disables service(s)
  evasion execution
- Stops running service(s)
  evasion execution
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

discoveryevasionexecutionspywarestealerupx

behavioral2

discoveryevasionexecutionspywarestealerupx