General

  • Target

    8202ecd499a1ba153a22b74ecc1e2305_JaffaCakes118

  • Size

    414KB

  • Sample

    241031-g6ps6ssfml

  • MD5

    8202ecd499a1ba153a22b74ecc1e2305

  • SHA1

    e29955281d51bcf8066c130b816034ae404dd72a

  • SHA256

    d95f251484840efb74c8ebb7a2fbfc904be41ec62e64bdb125dd94dc5d7f5d55

  • SHA512

    39450c403c7020b2f290068cd85d9d574ccf7daf6936add27699faa8be0641dad4180a593e15cbc5d45330e4c0399afcff23f316eb1cdfaa6f885481d19547ca

  • SSDEEP

    12288:Xw4zKQsJeN9kUvInsw0HehUxX1yIxjvilZxuzQIo4N:XdzKGM0+SjyIpilZ40P4N

Malware Config

Targets

    • Target

      8202ecd499a1ba153a22b74ecc1e2305_JaffaCakes118

    • Size

      414KB

    • MD5

      8202ecd499a1ba153a22b74ecc1e2305

    • SHA1

      e29955281d51bcf8066c130b816034ae404dd72a

    • SHA256

      d95f251484840efb74c8ebb7a2fbfc904be41ec62e64bdb125dd94dc5d7f5d55

    • SHA512

      39450c403c7020b2f290068cd85d9d574ccf7daf6936add27699faa8be0641dad4180a593e15cbc5d45330e4c0399afcff23f316eb1cdfaa6f885481d19547ca

    • SSDEEP

      12288:Xw4zKQsJeN9kUvInsw0HehUxX1yIxjvilZxuzQIo4N:XdzKGM0+SjyIpilZ40P4N

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks