Overview

overview

10

Static

static

10

02ce0f5015...18.exe

windows7-x64

10

02ce0f5015...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    02ce0f50156c5f50b5126e1185c09f81_JaffaCakes118

  • Size

    1.5MB

  • Sample

    240930-xkg47szgjq

  • MD5

    02ce0f50156c5f50b5126e1185c09f81

  • SHA1

    5ee2c81a6d3a69c760df9afea14f90f897186398

  • SHA256

    8fa095b2a5d9876f09f6275545fe61a06b51ba771f2ee2d873b2914a63243a70

  • SHA512

    a9bc358b6276cb3fdb4aacaf4fb870277045fcc3cc798637b5b178ffeaf1c68b51122c1cc9f7721b7f6d06bb575e780af35ba9bb722c94fd73f16b43db85d1b6

  • SSDEEP

    24576:FHhoAjL7/hhUF54clNf7lhhUF54clNf766uHAW92zt/sWu2BSMCqD0RU:jLto54clRo54cl8LH+tkWJ0Xy

Score
10/10
blackguarddiscoveryspywarestealer

Malware Config

Targets

    • Target

      02ce0f50156c5f50b5126e1185c09f81_JaffaCakes118

    • Size

      1.5MB

    • MD5

      02ce0f50156c5f50b5126e1185c09f81

    • SHA1

      5ee2c81a6d3a69c760df9afea14f90f897186398

    • SHA256

      8fa095b2a5d9876f09f6275545fe61a06b51ba771f2ee2d873b2914a63243a70

    • SHA512

      a9bc358b6276cb3fdb4aacaf4fb870277045fcc3cc798637b5b178ffeaf1c68b51122c1cc9f7721b7f6d06bb575e780af35ba9bb722c94fd73f16b43db85d1b6

    • SSDEEP

      24576:FHhoAjL7/hhUF54clNf7lhhUF54clNf766uHAW92zt/sWu2BSMCqD0RU:jLto54clRo54cl8LH+tkWJ0Xy

    Score
    10/10
    blackguardstealerdiscoveryspyware

    • BlackGuard

      Infostealer first seen in Late 2021.

      stealerblackguard

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks