2e6720122888bbca4d7d9a52e2ff6576a1cd0b228e1e28bb2af95445cfaf48f4 | Triage

Sharing

General

Target

fd0269ca5f7b66eeb24bf3626e6cd738_JaffaCakes118
Size

3.3MB
Sample

240928-yec4qswcng
MD5

fd0269ca5f7b66eeb24bf3626e6cd738
SHA1

8d170f2efbd12612f020f2580058f156f673b874
SHA256

2e6720122888bbca4d7d9a52e2ff6576a1cd0b228e1e28bb2af95445cfaf48f4
SHA512

627349700d65a1d7c9d0510b2d23144695cf963016e3f9e791e3ad5160d6976f3f6c903f16f34c6f3b9bc1ef11f3792179d7b7dc65de01b1fbed76f4ff3992c3
SSDEEP

49152:Czsy4VsUGTzLUvmqEFKSmCIo5qOC8Ro4SdK5z9rGOT6ixTgFdT+6+jkgNoYs2imF:nzGTzLUOKw21Cz9rGC6ixk+Ljkp17

Score

7^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  fd0269ca5f7b66eeb24bf3626e6cd738_JaffaCakes118
- Size
  
  3.3MB
- MD5
  
  fd0269ca5f7b66eeb24bf3626e6cd738
- SHA1
  
  8d170f2efbd12612f020f2580058f156f673b874
- SHA256
  
  2e6720122888bbca4d7d9a52e2ff6576a1cd0b228e1e28bb2af95445cfaf48f4
- SHA512
  
  627349700d65a1d7c9d0510b2d23144695cf963016e3f9e791e3ad5160d6976f3f6c903f16f34c6f3b9bc1ef11f3792179d7b7dc65de01b1fbed76f4ff3992c3
- SSDEEP
  
  49152:Czsy4VsUGTzLUvmqEFKSmCIo5qOC8Ro4SdK5z9rGOT6ixTgFdT+6+jkgNoYs2imF:nzGTzLUOKw21Cz9rGC6ixk+Ljkp17
Score

7^/10

discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2