Overview

overview

10

Static

static

3

ed2d5d0ed5...18.exe

windows7-x64

10

ed2d5d0ed5...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ed2d5d0ed5d66ef9ede8fe9b806b2891_JaffaCakes118

  • Size

    76KB

  • Sample

    240920-j4n5zaxbrr

  • MD5

    ed2d5d0ed5d66ef9ede8fe9b806b2891

  • SHA1

    c5cecc6e4d72b45f59c228846f4310215b3d2d79

  • SHA256

    cc6c736d9ebdb4be8ae19055110d601f4f308314d8a2f3c1c0b50cbe4ac15be2

  • SHA512

    a224bbfb2d931fb68d1418e891cde3b4746989ccc5d66d076bc28e0e588c4d5710692ce91c080b57e776088209359a1bfa2d8691371c3a6a1147970e532c22aa

  • SSDEEP

    1536:fW8QnR+yvHeZT71JeKtqT0EZqz/mp1tKIFEs:eRmT5JXqgEQyp1tKqEs

Score
10/10
credential_accessdiscoverypersistencespywarestealer

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    zapresic

Targets

    • Target

      ed2d5d0ed5d66ef9ede8fe9b806b2891_JaffaCakes118

    • Size

      76KB

    • MD5

      ed2d5d0ed5d66ef9ede8fe9b806b2891

    • SHA1

      c5cecc6e4d72b45f59c228846f4310215b3d2d79

    • SHA256

      cc6c736d9ebdb4be8ae19055110d601f4f308314d8a2f3c1c0b50cbe4ac15be2

    • SHA512

      a224bbfb2d931fb68d1418e891cde3b4746989ccc5d66d076bc28e0e588c4d5710692ce91c080b57e776088209359a1bfa2d8691371c3a6a1147970e532c22aa

    • SSDEEP

      1536:fW8QnR+yvHeZT71JeKtqT0EZqz/mp1tKIFEs:eRmT5JXqgEQyp1tKqEs

    Score
    10/10
    credential_accessdiscoverypersistencespywarestealer

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks