General

  • Target

    fa08d221c58041897bd9ec1b808e423c_JaffaCakes118

  • Size

    855KB

  • Sample

    240927-jz4pvssglj

  • MD5

    fa08d221c58041897bd9ec1b808e423c

  • SHA1

    5c1cd215766875eefc856d989904201c782c7dc0

  • SHA256

    7c45c5ffaeb697da39489e3a6ff6945aa3f8ca737f5a278c435646e7a8602767

  • SHA512

    956b15cc9ae1d60c982e96bab9cf9102656d0a3282a0cb73dea40d2f858d5bc839cb390721634b1d8c4b86ec59cdf49cd08948fd3e730ef872eb9f42021e2c0d

  • SSDEEP

    12288:7EOalj6aVymyzQSpPVNmTkSMi8fVLO6HylJgoynwOU1nwiGey7awQStfDARwo:7yj6aDS/NCMXJvHkJ3NwiLmawQNRwo

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    efforting@

Targets

    • Target

      Document_028472.exe

    • Size

      905KB

    • MD5

      d82790a83761efb5c7727fb60db48723

    • SHA1

      0345bbca4671daf283f40b20fa477ed8a84ba9a4

    • SHA256

      f305b0d150fd1cae5ece3e13a86f95d7a4f25683930a57988878198b7f547ba4

    • SHA512

      bb835bb5a954e206a3605eebee9ecaa6986af0e8a222fcb8108eb62ca856b183c10f2c58efcad803a47aabf70122cfe288a484a76eced03d74d6a6a06615422d

    • SSDEEP

      12288:yFg3OaHjYaVymEzQSpHVNmLkS2i8fHLO2HyjJasQlYOUDhw0Gey7awQAtfDAvwIq:ZjYa5SHNU2XzPH8JHrC0LmawQnvw

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger Main payload

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks