Overview

overview

7

Static

static

3

0c18730862...18.exe

windows7-x64

7

0c18730862...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0c18730862b992f3f7f40c6a1c078d0a_JaffaCakes118

  • Size

    18KB

  • Sample

    241002-xrq1pavhmc

  • MD5

    0c18730862b992f3f7f40c6a1c078d0a

  • SHA1

    37726e20610a66a1fa94972e597dd8f5902379b5

  • SHA256

    cc6843412729913056d33966368f238a0843bee8c96f2ff5530503a11e5f4dff

  • SHA512

    c08277d7f916cee20f87f7f3fb335a986f4d7c0fa154f632fec349c521f5c973b3878d33983087267d41863e972286ea61b69577b6c64531884d0fb411fbd647

  • SSDEEP

    384:o3jbVWeAs//zsf/IraBmke824E7Xl8OtnrbdT8lSo4cCoxk:QjbFB4IuYEErl8qn358s7

Score
7/10
credential_accessdiscoveryspywarestealer

Malware Config

Targets

    • Target

      0c18730862b992f3f7f40c6a1c078d0a_JaffaCakes118

    • Size

      18KB

    • MD5

      0c18730862b992f3f7f40c6a1c078d0a

    • SHA1

      37726e20610a66a1fa94972e597dd8f5902379b5

    • SHA256

      cc6843412729913056d33966368f238a0843bee8c96f2ff5530503a11e5f4dff

    • SHA512

      c08277d7f916cee20f87f7f3fb335a986f4d7c0fa154f632fec349c521f5c973b3878d33983087267d41863e972286ea61b69577b6c64531884d0fb411fbd647

    • SSDEEP

      384:o3jbVWeAs//zsf/IraBmke824E7Xl8OtnrbdT8lSo4cCoxk:QjbFB4IuYEErl8qn358s7

    Score
    7/10
    credential_accessdiscoveryspywarestealer

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks