b8067a09ffa4e6bff39c85def221028bd9be757a9a95df122725c1c5f551edff | Triage

Sharing

General

Target

3b52bc5d9c5a79781da41215e15fef98_JaffaCakes118
Size

1.5MB
Sample

241012-wfqp4sshrd
MD5

3b52bc5d9c5a79781da41215e15fef98
SHA1

3a8d05f8a9b055d9dbc41e880a1b76ee0add0dd0
SHA256

b8067a09ffa4e6bff39c85def221028bd9be757a9a95df122725c1c5f551edff
SHA512

3d2756810617b74f99b987427e1c5411eca581e6af62b33db6c42d7783c8f59355045b013ba734b052bc35fde24ccd18069a566cfcab083fbd971a8a767da2c8
SSDEEP

24576:1l6tl6tl6gX5dlQ3ntA7wnNTBgQf9S7WUtLpwbtLpw:R5dlLwnNTBzfUbtL2tL

Score

7^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  3b52bc5d9c5a79781da41215e15fef98_JaffaCakes118
- Size
  
  1.5MB
- MD5
  
  3b52bc5d9c5a79781da41215e15fef98
- SHA1
  
  3a8d05f8a9b055d9dbc41e880a1b76ee0add0dd0
- SHA256
  
  b8067a09ffa4e6bff39c85def221028bd9be757a9a95df122725c1c5f551edff
- SHA512
  
  3d2756810617b74f99b987427e1c5411eca581e6af62b33db6c42d7783c8f59355045b013ba734b052bc35fde24ccd18069a566cfcab083fbd971a8a767da2c8
- SSDEEP
  
  24576:1l6tl6tl6gX5dlQ3ntA7wnNTBgQf9S7WUtLpwbtLpw:R5dlLwnNTBzfUbtL2tL
Score

7^/10

aspackv2 discovery persistence spyware stealer
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

aspackv2discoverypersistencespywarestealer

behavioral2

aspackv2discoverypersistencespywarestealer