Analysis
-
max time kernel
94s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
08-01-2025 14:35
General
-
Target
JaffaCakes118_a4dbacb9093cc059417e7e5cb025c838.exe
-
Size
5.8MB
-
MD5
a4dbacb9093cc059417e7e5cb025c838
-
SHA1
48ac7b81b2301790d4a8afe3cbfdaf8d54682be0
-
SHA256
d9463ab48b318ca4c9f1b36ee3d298576b8ab7c95c7c445850a16a56bb4a6127
-
SHA512
fc9bee0f632a63453d8980170d22151bc73bc1dd75f108b61f02d3ee7da1c31f8a387376d48a8fb9ad759efcb6657879998de6e79bbb24a7603e4624fed4c4a3
-
SSDEEP
98304:2POtHpKFMtpFE138XQsMgWlA/1Ge9kPTaYLMbTKSfuLBk+zJ5nL7HNmS0yiEUUu0:fHpKIbrXQsMg/NqPOkMvKSSjJ5nLbNWS
Malware Config
Extracted
pandastealer
1.11
http://f0592163.xsph.ru
Signatures
-
Panda Stealer payload 4 IoCs
-
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
Pandastealer family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
VMProtect packed file 4 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a4dbacb9093cc059417e7e5cb025c838.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a4dbacb9093cc059417e7e5cb025c838.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
-
Filesize
9.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
9.8MB
-
Filesize
3.3MB
-
Filesize
9.8MB
-
Filesize
9.8MB
-
Filesize
3.3MB