735dbc784015d89fd6ce5c519553abe221f5e6a098ac7dd483da43279943ad4c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

00473c17d7d01ba97147ea46e1fab66d_JaffaCakes118
Size

2.7MB
Sample

240930-jv136stfkr
MD5

00473c17d7d01ba97147ea46e1fab66d
SHA1

898d1a1c095a388eba3c3dc213c9133ffe1a528c
SHA256

735dbc784015d89fd6ce5c519553abe221f5e6a098ac7dd483da43279943ad4c
SHA512

4f885fdd242bfc5f950265fd0f39fea59ae80b466f0f1b8bed7d7ca15bcd31b4b91bd4cffed47977e51e5cfd61f247f02252702afe046f257df07b8bbfdb56b6
SSDEEP

49152:xitV1YKeMH6LQ8iR2acHU1aKKbw9CFRdnozTt9KoQ6nzmb3yeB0wbzEu9mpu1sCW:xi1YKNOicacmubhFQzB97zmblB0wbzRo

Score

7^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  00473c17d7d01ba97147ea46e1fab66d_JaffaCakes118
- Size
  
  2.7MB
- MD5
  
  00473c17d7d01ba97147ea46e1fab66d
- SHA1
  
  898d1a1c095a388eba3c3dc213c9133ffe1a528c
- SHA256
  
  735dbc784015d89fd6ce5c519553abe221f5e6a098ac7dd483da43279943ad4c
- SHA512
  
  4f885fdd242bfc5f950265fd0f39fea59ae80b466f0f1b8bed7d7ca15bcd31b4b91bd4cffed47977e51e5cfd61f247f02252702afe046f257df07b8bbfdb56b6
- SSDEEP
  
  49152:xitV1YKeMH6LQ8iR2acHU1aKKbw9CFRdnozTt9KoQ6nzmb3yeB0wbzEu9mpu1sCW:xi1YKNOicacmubhFQzB97zmblB0wbzRo
Score

7^/10

discovery spyware stealer
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2