General

  • Target

    fc745187c3ff72af13838159faa9a0a6_JaffaCakes118

  • Size

    356KB

  • Sample

    240928-rc27hssclg

  • MD5

    fc745187c3ff72af13838159faa9a0a6

  • SHA1

    0314cd01b46402c5a072fca5ede0a00185be41a1

  • SHA256

    baf0d443bc28eadc944d6695ad8366a794eb2512a2fd55e1b0427147f35607c7

  • SHA512

    4e794f3fd3e7f6ee41277ec4ae4d4f38e1efca105e55f20c4f42a1a64d27dbe76341af0f81bf09ae6970f88de1cce0dd68507456cc9d3290a94559eab1a67fcd

  • SSDEEP

    6144:t2cbgNPPQTEmvw2NCds7f0gxZcLYPnuK7IkljTE/taQ3fYUJm4MhPpbs8sS:t2agNnQg6NCdXgwL0Rls8QLQxh

Malware Config

Targets

    • Target

      sample

    • Size

      513KB

    • MD5

      35ca357195e9df3237072740c0934f38

    • SHA1

      9547ba9b31f81bc486b44725d7d90f14d6b693c9

    • SHA256

      9c4a2d8473718bdb1725450b6f0567098006b9aa89fbd913acab1bab0857143d

    • SHA512

      054a820aa9aa9b3ee0c36517b265ee96d201b313e1860b1eb33c9068c4043746ac494ffb1f01c2f78589a5461b63c73a332a9e6184f7b54e3aa676e2a3c45476

    • SSDEEP

      6144:k385JsQbbCXl8o22wikYT0nNSZsWrK+9OhYnsRf0gbVcLYPnuKzIMljTwltaoFfG:+UsQal8o22kYTBup6nXg2Lu/lo+o9u

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger Main payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks