5e53e4a133099a931355324649198354463632f4fcb82e4cf3727bf745cebb75

Sharing

Copy URL Twitter E-mail

General

Target
CakeStealer.7z
Size 984KB
Sample260707-t8htvsax5r
SHA256 5e53e4a133099a931355324649198354463632f4fcb82e4cf3727bf745cebb75
MD5 3124d39cc3f09cb2fccfeb00793e19ec
SHA1 4d30ec608873cb5a46b7b8b20e75bee545b70cc9
SHA512 f74739d4ec3a7fe8e150c735cc23fe0fd2dc5f2d03b94075c24f3f0268340e369dd6cda28010ad8c09b5f4f01dc461b37f4a1914b56880452435795e4969b24a
SSDEEP 24576:e3XVAFlkkPLC2su/hGcPwG0hYOnvLDRzFG64d6:w1k22y6wGqFvLdg9d6
TLSH
T1762533F49996F70A944A20F3D84EB730B567E6AE8337498EA450B47A4B44DD385FF380
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

persistence

Malware Config

Targets

- Target
  CakeStealer.7z
- Size 984KB
- SHA256 5e53e4a133099a931355324649198354463632f4fcb82e4cf3727bf745cebb75
- MD5 3124d39cc3f09cb2fccfeb00793e19ec
- SHA1 4d30ec608873cb5a46b7b8b20e75bee545b70cc9
- SHA512 f74739d4ec3a7fe8e150c735cc23fe0fd2dc5f2d03b94075c24f3f0268340e369dd6cda28010ad8c09b5f4f01dc461b37f4a1914b56880452435795e4969b24a
- SSDEEP 24576:e3XVAFlkkPLC2su/hGcPwG0hYOnvLDRzFG64d6:w1k22y6wGqFvLdg9d6
- TLSH
  T1762533F49996F70A944A20F3D84EB730B567E6AE8337498EA450B47A4B44DD385FF380
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
behavioral1 behavioral2
- Target
  CakeStealer.exe
- Size 1.2MB
- SHA256 863f9d01539ae5682b57b4b65d9e9165e851d19814dd235646dfda9ecacef46e
- MD5 1e0079c96ac82bd9b3974f5171293a58
- SHA1 a17421e3bbf7a07f1d696550f03be03ed7c87aa9
- SHA512 1ff9a1c89f1543d8497f5223d2b25983f8104b322229517c3d581635c3383560d38d72c5f2caa94656c84bb162be6b5d652bdb8b3902e9438630b3dbed0d1d19
- SSDEEP 24576:/lvXYZUhc5PkZc+LhLm6w30I0pxYcxMNkz3324mr:/5XYZUhYMnBm6w30IsBxMGzRmr
- TLSH
  T15745021DA2E64E42D2562FF484D6CA3413F2E78B6173DF4E9A4512F83D423F68D862D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  costura.dll
- Size 5KB
- SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
- MD5 109bd38d2107f41573c48544992ead99
- SHA1 028e9832f421f11f9497c610f1734e0f3d868037
- SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
- SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
- TLSH
  T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  costura.pdb
- Size 7KB
- SHA256 fbb47bfd057253e9461bc7fe661eb8ad273451782f3e227b8db8f88b54cea186
- MD5 dd3394a0ba6f7158d029e1c3a31b7a85
- SHA1 806f4c19b2d7fd9e3b836269ec07647019a29e95
- SHA512 2fbedae58d16bfe20954094e5c7541e1b25310107571e94f7bea35b2217aa634197ef147afb9ffbd9c59aa0f7e209cf2a97349c3503077758502bf7a776e2575
- SSDEEP 192:yMD/wix+PI6jMai+NLy5nj4SCBg5MRkCIFQkC8g7AHOuXk/N/8Hu04:y8YPI6jMai+NLy5nj4SCm5Mz6QkOAHO/
- TLSH
  T1A4F1B33F5748C463C89959720521C49CB6B343202670ED78F3DB2608EDAF69AC7B5772
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  metroframework.design.dll
- Size 16KB
- SHA256 0a4a96082e25767e4697033649b16c76a652e120757a2cecab8092ad0d716b65
- MD5 ab4c3529694fc8d2427434825f71b2b8
- SHA1 7be378e382e43eae84f1567b3570bca9a67e7697
- SHA512 02d7935f68c30457da79ad7b039b22caed11d8aedfec7c96619ac6da59ceb7c5e7a758dced64ec02d31c37a2befccdc8eb59be9e2dc849aa2bc22fabb5fa00a5
- SSDEEP 384:HYAB8KPALBamLG3gckiBTVU6sgFf5L7WTOYKpKG4rw:HyLBamS3gckiBTVkgiVXr
- TLSH
  T114723205B2FC423AE7EFC5336BA945503D74A90DA872CA1C1CE80AF959F67424AD1F53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  metroframework.dll
- Size 345KB
- SHA256 c2c12d31b4844e29de31594fc9632a372a553631de0a0a04c8af91668e37cf49
- MD5 34ea7f7d66563f724318e322ff08f4db
- SHA1 d0aa8038a92eb43def2fffbbf4114b02636117c5
- SHA512 dceb1f9435b9479f6aea9b0644ba8c46338a7f458c313822a9d9b3266d79af395b9b2797ed3217c7048db8b22955ec6fe8b0b1778077fa1de587123ad9e6b148
- SSDEEP 6144:M4S7k5hdCpU4YqfkUGz6KpQQZQHDXjNCdOZgLdL5DXBK:M4S7k5hdCEQHP1Zgj
- TLSH
  T1C8745C111399452AE1FF423AB457084187F7AE12F6BEEBAD69CCE0EC5F937414A42363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  metroframework.fonts.dll
- Size 656KB
- SHA256 c843869aaca5135c2d47296985f35c71ca8af4431288d04d481c4e46cc93ee26
- MD5 65ef4b23060128743cef937a43b82aa3
- SHA1 cc72536b84384ec8479b9734b947dce885ef5d31
- SHA512 d06690f9aac0c6500aed387f692b3305dfc0708b08fc2f27eaa44b108908ccd8267b07f8fb8608eef5c803039caeabf8f88a18b7e5b1d850f32bbb72bcd3b0b7
- SSDEEP 12288:O+/9JcJlYqCNktA+SXfGpq2fHowSqCNktA+SXfvJR9FrIJJaqCNktA+SXfUC:O+/3qlrCNoh+UqgIwhCNoh+JR9FrIJJw
- TLSH
  T1D2E429B5760139E6EF11C4B7C260FD80192BB863A77B402A68E3077A88575CDFE53E46
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  newtonsoft.json.dll
- Size 704KB
- SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
- MD5 24704261e701b49b51e40c1292ed149e
- SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
- SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
- SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
- TLSH
  T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16