General

  • Target

    fbe5c174659e27a75b6fe7c1370dc70e_JaffaCakes118

  • Size

    986KB

  • Sample

    240928-kdqrjsydmc

  • MD5

    fbe5c174659e27a75b6fe7c1370dc70e

  • SHA1

    a3d3b33671947f0734ae7d7580153e3d9f396131

  • SHA256

    0d1c6b95f3224dc208c5d522a804f373e9f043379582b53c007bbc849f20509b

  • SHA512

    70947125e22eb63f7e4f4846c67d1fc3c0dfc05af99be8b6f59f87fbfea917036169f4654d4ff965b465b3e8f0eb117ab4ea5245f46ace25c2f65882dd8d3735

  • SSDEEP

    24576:HrYUhzRsCg6Yn++QKS8ruX5OvV52cq1bLDgwzGs:L+Cg6KbbNCpm2cqVgqGs

Malware Config

Targets

    • Target

      fbe5c174659e27a75b6fe7c1370dc70e_JaffaCakes118

    • Size

      986KB

    • MD5

      fbe5c174659e27a75b6fe7c1370dc70e

    • SHA1

      a3d3b33671947f0734ae7d7580153e3d9f396131

    • SHA256

      0d1c6b95f3224dc208c5d522a804f373e9f043379582b53c007bbc849f20509b

    • SHA512

      70947125e22eb63f7e4f4846c67d1fc3c0dfc05af99be8b6f59f87fbfea917036169f4654d4ff965b465b3e8f0eb117ab4ea5245f46ace25c2f65882dd8d3735

    • SSDEEP

      24576:HrYUhzRsCg6Yn++QKS8ruX5OvV52cq1bLDgwzGs:L+Cg6KbbNCpm2cqVgqGs

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger Main payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks