Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
10-01-2025 21:20
General
-
Target
JaffaCakes118_ee9a39289b1515a19727989d5aa4ba18.exe
-
Size
5.6MB
-
MD5
ee9a39289b1515a19727989d5aa4ba18
-
SHA1
5f39c931de7b85579efd964f914a5b4b73f127ee
-
SHA256
e388278f58445533165adf816fa66770373de91581acfd15f85bc8d33c6b9ae1
-
SHA512
89569cda298b800e3c3f7be0d074a25465388771fefaaf5b98b5ab955b5f7148454f04fca79c59984e6b441bd094bb7bfb287e7764e03085bac702b8453009a1
-
SSDEEP
98304:Qr1eZRfOlXDCcQrgVV6EU4YKV6f+LNCFUdjhCgoJIB0BaOXWgMkCCAMOMvuaXwLH:QafONCZgVY46f+6UNPNuXdAMOIULyt8
Malware Config
Signatures
-
Panda Stealer payload 3 IoCs
-
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
Pandastealer family
-
Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
-
Shurk Stealer payload 3 IoCs
-
Shurk family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ee9a39289b1515a19727989d5aa4ba18.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ee9a39289b1515a19727989d5aa4ba18.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.2MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
3.2MB