General

  • Target

    4a4ba4c3d817f5dec20168204945809b_JaffaCakes118

  • Size

    420KB

  • Sample

    241015-2dcncszhmg

  • MD5

    4a4ba4c3d817f5dec20168204945809b

  • SHA1

    69c04303edee7a15af2760144610f2ba89655573

  • SHA256

    67c4eb554e88b85c01e46d32d4f65a7119ea914c8a49451e9553ad45ad1ef51b

  • SHA512

    82a488fa1b13c092a616f3e9ea2aac268c1d6b0f7775cd80c9817078cfd44d6f620ac748bd09e88e4688df962d5ac022bc810fa1799b70195c911319edff35ea

  • SSDEEP

    6144:0VEaAUYgRkiRfJc7ys9Ug5j8on5GtHIuu3bG7yRncvwf+0Zz1VvhyxeMnyfTr8jJ:0rHbR2ys9H5j8BHIu74ndf+0dW5IrCN

Malware Config

Targets

    • Target

      4a4ba4c3d817f5dec20168204945809b_JaffaCakes118

    • Size

      420KB

    • MD5

      4a4ba4c3d817f5dec20168204945809b

    • SHA1

      69c04303edee7a15af2760144610f2ba89655573

    • SHA256

      67c4eb554e88b85c01e46d32d4f65a7119ea914c8a49451e9553ad45ad1ef51b

    • SHA512

      82a488fa1b13c092a616f3e9ea2aac268c1d6b0f7775cd80c9817078cfd44d6f620ac748bd09e88e4688df962d5ac022bc810fa1799b70195c911319edff35ea

    • SSDEEP

      6144:0VEaAUYgRkiRfJc7ys9Ug5j8on5GtHIuu3bG7yRncvwf+0Zz1VvhyxeMnyfTr8jJ:0rHbR2ys9H5j8BHIu74ndf+0dW5IrCN

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks