Overview

overview

10

Static

static

10

170a6f8ca6...18.exe

windows7-x64

9

170a6f8ca6...18.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    170a6f8ca6ba51af30b38863ed318edc_JaffaCakes118

  • Size

    592KB

  • Sample

    241005-kzj6ws1bra

  • MD5

    170a6f8ca6ba51af30b38863ed318edc

  • SHA1

    a4eb53f9056f418cf264259ff83fa1f8a3b00355

  • SHA256

    df78cea44f788ca04c800722f9a97d7d306f2af7e517f67f50d1dca11b561613

  • SHA512

    26d3182d3ecb5cf7f27bd5442c956bbecbcac308c13c8c99f4d06db8ddcc7164e90a2f85b1320bc9fe3ec778569ba5f18ebde4dba1909bef664979e5c4ae0c59

  • SSDEEP

    12288:ZqGq3C4c0C3jaJBaPHaKx8Xk8NxagaElleYYhM6:UGczc3Ywt8XzNxagaClzU

Score
10/10
isrstealercollectiondiscoveryspywarestealerupx

Malware Config

Targets

    • Target

      170a6f8ca6ba51af30b38863ed318edc_JaffaCakes118

    • Size

      592KB

    • MD5

      170a6f8ca6ba51af30b38863ed318edc

    • SHA1

      a4eb53f9056f418cf264259ff83fa1f8a3b00355

    • SHA256

      df78cea44f788ca04c800722f9a97d7d306f2af7e517f67f50d1dca11b561613

    • SHA512

      26d3182d3ecb5cf7f27bd5442c956bbecbcac308c13c8c99f4d06db8ddcc7164e90a2f85b1320bc9fe3ec778569ba5f18ebde4dba1909bef664979e5c4ae0c59

    • SSDEEP

      12288:ZqGq3C4c0C3jaJBaPHaKx8Xk8NxagaElleYYhM6:UGczc3Ywt8XzNxagaClzU

    Score
    9/10
    collectiondiscoveryspywarestealerupx

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks