8117231b531353101f5f9dd888c49940ac68d04a4161492026131cc9218cdf1d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3703342c48ce27d838978a5fd522b5c9_JaffaCakes118
Size

652KB
Sample

241011-1x1nvs1ckk
MD5

3703342c48ce27d838978a5fd522b5c9
SHA1

edf6e9e24e913c364680bca60b2dc6cdd08490ba
SHA256

8117231b531353101f5f9dd888c49940ac68d04a4161492026131cc9218cdf1d
SHA512

5871591da5783c1cef43a518215abdb976b57051e5f327715dc0d98882d4476aab2984be1a747a7099f54e7888401764b77342e28cb5e2cde40983d49292be96
SSDEEP

12288:i0SlJmmF99W7CQV1POhmmp+ZGnTtmg3Fxx7JvdakTNacsvH:rJw9g7CQjcmi+QnTN3vJxdjpaD

Score

7^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  3703342c48ce27d838978a5fd522b5c9_JaffaCakes118
- Size
  
  652KB
- MD5
  
  3703342c48ce27d838978a5fd522b5c9
- SHA1
  
  edf6e9e24e913c364680bca60b2dc6cdd08490ba
- SHA256
  
  8117231b531353101f5f9dd888c49940ac68d04a4161492026131cc9218cdf1d
- SHA512
  
  5871591da5783c1cef43a518215abdb976b57051e5f327715dc0d98882d4476aab2984be1a747a7099f54e7888401764b77342e28cb5e2cde40983d49292be96
- SSDEEP
  
  12288:i0SlJmmF99W7CQV1POhmmp+ZGnTtmg3Fxx7JvdakTNacsvH:rJw9g7CQjcmi+QnTN3vJxdjpaD
Score

7^/10

discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops Chrome extension
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer