b3c23f52efe4f71914da5946d734b46acb2d137b5e93214ceb8a3fd32ea18191 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

11dc242fdcc4920c06a85970ce85e7f2_JaffaCakes118
Size

3.3MB
Sample

241004-e8rdnsyerc
MD5

11dc242fdcc4920c06a85970ce85e7f2
SHA1

138640cf6e6270e5783f0c393a53010a4fa0c7b0
SHA256

b3c23f52efe4f71914da5946d734b46acb2d137b5e93214ceb8a3fd32ea18191
SHA512

fec8b7c6b2c4fcec9b45905314bc6a45c440c2905f200f6817751e431addfad84de26eb3088a1687d29e2a821c442412e005ad212eae60cda46e0bd9b1c21b9f
SSDEEP

98304:inZdKY36YYoagQPmG11j01gRf2JKEh9rOy4jibTnU:Gn5eKR2feHh9rl4+bT

Score

7^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  11dc242fdcc4920c06a85970ce85e7f2_JaffaCakes118
- Size
  
  3.3MB
- MD5
  
  11dc242fdcc4920c06a85970ce85e7f2
- SHA1
  
  138640cf6e6270e5783f0c393a53010a4fa0c7b0
- SHA256
  
  b3c23f52efe4f71914da5946d734b46acb2d137b5e93214ceb8a3fd32ea18191
- SHA512
  
  fec8b7c6b2c4fcec9b45905314bc6a45c440c2905f200f6817751e431addfad84de26eb3088a1687d29e2a821c442412e005ad212eae60cda46e0bd9b1c21b9f
- SSDEEP
  
  98304:inZdKY36YYoagQPmG11j01gRf2JKEh9rOy4jibTnU:Gn5eKR2feHh9rl4+bT
Score

7^/10

discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer