General

  • Target

    441c29beb785825773565a52f663ab64_JaffaCakes118

  • Size

    1.2MB

  • Sample

    241014-zkxk1awane

  • MD5

    441c29beb785825773565a52f663ab64

  • SHA1

    310041ea7b3fc883df2b81516f42b0ae311bf6cd

  • SHA256

    a7c204f16dbae8eb221bb143d67e5f926dd5fe71a0c07b4ee19d0893872061a3

  • SHA512

    cb4d8ae091cb07a441041e824f3ef1d2b2d606eac3be3c57d96c8dde5b259f1b5dbe0714ff4639df0d12ba7fc1b7c2b486479197316c9521ca48b85a4ee05021

  • SSDEEP

    24576:1Lxy7ZcQ7wAXRAbhDdAGLMMiw4Fj0qN+x4QCO490V94fYgtvGk6GA:u7ZpFi8j5O497oDGA

Malware Config

Targets

    • Target

      441c29beb785825773565a52f663ab64_JaffaCakes118

    • Size

      1.2MB

    • MD5

      441c29beb785825773565a52f663ab64

    • SHA1

      310041ea7b3fc883df2b81516f42b0ae311bf6cd

    • SHA256

      a7c204f16dbae8eb221bb143d67e5f926dd5fe71a0c07b4ee19d0893872061a3

    • SHA512

      cb4d8ae091cb07a441041e824f3ef1d2b2d606eac3be3c57d96c8dde5b259f1b5dbe0714ff4639df0d12ba7fc1b7c2b486479197316c9521ca48b85a4ee05021

    • SSDEEP

      24576:1Lxy7ZcQ7wAXRAbhDdAGLMMiw4Fj0qN+x4QCO490V94fYgtvGk6GA:u7ZpFi8j5O497oDGA

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Uses the VBS compiler for execution

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks