Overview

overview

10

Static

static

1

especifica...PDF.js

windows7-x64

10

especifica...PDF.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f1710e83515bcdc7402a63ef17f921b5_JaffaCakes118

  • Size

    1KB

  • Sample

    240922-g2dv4svhnr

  • MD5

    f1710e83515bcdc7402a63ef17f921b5

  • SHA1

    41b4ad5b45dab476d4d20227102abc308fa5d3d9

  • SHA256

    5767017f3c67cbe1edad867f5606194f99f46309701e97499599ddb449e2fb8d

  • SHA512

    d2316acff9f621ff9bd58a9371e1bb1881e80075874bf157e52e89742ddcda9712c4c587b3c0a57235603f26141f07c126d2d01466dd1747d3cbfda48cce4407

Score
10/10
massloggercollectioncredential_accessdiscoveryexecutionspywarestealer

Malware Config

Targets

    • Target

      especificación del proyecto_doc04361120200924113759_ACF.28668_DPJ2020012681085.PDF.js

    • Size

      3KB

    • MD5

      ea79f170b2f7531f6aae0190cfac32d3

    • SHA1

      06a49ce472f34b717e2ef5ea2fe758b36bbeaf8a

    • SHA256

      8f0a1868051989d74f2a968a6f326c7ad3c442b4d1b90933a93e3851bebc26a4

    • SHA512

      9a79ca5c74671dca4fdf607fdbd67b1f42afac4239f5de83499cb8e70fd971a9a4c976599baeebb3e060f31229021d6f9110693ed0fd8d6237b2d4eedca94b4b

    Score
    10/10
    executionmassloggercollectioncredential_accessdiscoveryspywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main payload

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Blocklisted process makes network request

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks