f5b790c384ea6279d76f3d3353882592accacb665da9098daac4ff08df21173d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0207bc0a035ee5517f45279bab9f4528_JaffaCakes118
Size

740KB
Sample

240930-sq37easckl
MD5

0207bc0a035ee5517f45279bab9f4528
SHA1

95b318f786a7ca1767a2c6fbd71c00bcc72a033f
SHA256

f5b790c384ea6279d76f3d3353882592accacb665da9098daac4ff08df21173d
SHA512

a4cc7a77ad67e5f307e5b878207d8bbb9f33d3cdb8e8a8b7e1a3edabc5d6e6b905b1e8a9dc1e7fd0b187aec43d47028c649d04e624a671e90378a44d70e6acac
SSDEEP

12288:Wjv995MrKZbXG6CrTGnJEeE7AMvfJjI0zCMLoYCJJqTI4a0hpyCLaruLsKsF3+qt:WjvdNbfuTG+eWF5rCJJqkuzyCLarOsTz

Score

7^/10

discovery persistence spyware stealer upx

Malware Config

Targets

- Target
  
  0207bc0a035ee5517f45279bab9f4528_JaffaCakes118
- Size
  
  740KB
- MD5
  
  0207bc0a035ee5517f45279bab9f4528
- SHA1
  
  95b318f786a7ca1767a2c6fbd71c00bcc72a033f
- SHA256
  
  f5b790c384ea6279d76f3d3353882592accacb665da9098daac4ff08df21173d
- SHA512
  
  a4cc7a77ad67e5f307e5b878207d8bbb9f33d3cdb8e8a8b7e1a3edabc5d6e6b905b1e8a9dc1e7fd0b187aec43d47028c649d04e624a671e90378a44d70e6acac
- SSDEEP
  
  12288:Wjv995MrKZbXG6CrTGnJEeE7AMvfJjI0zCMLoYCJJqTI4a0hpyCLaruLsKsF3+qt:WjvdNbfuTG+eWF5rCJJqkuzyCLarOsTz
Score

7^/10

discovery persistence spyware stealer upx
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials in Registry

Discovery

Query Registry

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealerupx

behavioral2