Overview

overview

10

Static

static

3

b0c5094c2c...18.exe

windows7-x64

10

b0c5094c2c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b0c5094c2c677da2735dd39b7752e600_JaffaCakes118

  • Size

    17KB

  • Sample

    241129-mycrja1ndv

  • MD5

    b0c5094c2c677da2735dd39b7752e600

  • SHA1

    fc2accd937bbb23e1117b3ca0d0ebd9a075fa37d

  • SHA256

    c97e3b54f054fe14af64f9912fde6aaa69e9863e2bc0f7aff7df8cd47e11722d

  • SHA512

    e2dfb1179e53b03309fa9a9fbfefb3cca7b0779ebe816cd5d57059cdea9b5248e8fa200d4cabc9752e4fcf9efc1c826969e3e73c8648331db28bc28ca56e3b87

  • SSDEEP

    384:u/aI71le/ABYoKNMjbruXtXTwDGaHoPEMa7De:fI71leYBY7N6KXtXKGWoPEb

Score
10/10
credential_accessdiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      b0c5094c2c677da2735dd39b7752e600_JaffaCakes118

    • Size

      17KB

    • MD5

      b0c5094c2c677da2735dd39b7752e600

    • SHA1

      fc2accd937bbb23e1117b3ca0d0ebd9a075fa37d

    • SHA256

      c97e3b54f054fe14af64f9912fde6aaa69e9863e2bc0f7aff7df8cd47e11722d

    • SHA512

      e2dfb1179e53b03309fa9a9fbfefb3cca7b0779ebe816cd5d57059cdea9b5248e8fa200d4cabc9752e4fcf9efc1c826969e3e73c8648331db28bc28ca56e3b87

    • SSDEEP

      384:u/aI71le/ABYoKNMjbruXtXTwDGaHoPEMa7De:fI71leYBY7N6KXtXKGWoPEb

    Score
    10/10
    credential_accessdiscoverypersistencespywarestealer

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks