Overview

overview

10

Static

static

5

jaffacakes...c4.exe

windows10-2004-x64

10

jaffacakes...c4.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    jaffacakes118_e9c01cbcefd682be349b6ff9f91e3685a9c5a379e8417b00753d5021223603c4.bin
  • Size 13.5MB
  • Sample260912-dr286scc62
  • SHA256 e9c01cbcefd682be349b6ff9f91e3685a9c5a379e8417b00753d5021223603c4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
acreedhijackloaderdiscoveryinstallerloaderspywarestealer

Malware Config

Extracted

Family

  • hijackloader

Attributes
  • directory

    %ALLUSERSPROFILE%\d51901c26227fb29

  • inject_dll

    %windir%\SysWOW64\pla.dll

xor.hex

Extracted

Family

  • acreed

C2

  • telemetryapi.live

Attributes
  • block

    latest

  • call_obj

    {"to":"0xD13Fa758d18aCff16648D35a657DF929341dc6c1","data":"0x24c12bf6"}

  • header

    Content-Type: application/json

  • host

    https://data-seed-prebsc-1-s1.binance.org:8545

  • method

    eth_call

  • version

    2.0

XOR.hex

Targets

    • Target
      jaffacakes118_e9c01cbcefd682be349b6ff9f91e3685a9c5a379e8417b00753d5021223603c4.bin
    • Size 13.5MB
    • SHA256 e9c01cbcefd682be349b6ff9f91e3685a9c5a379e8417b00753d5021223603c4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryacreedhijackloaderinstallerloaderspywarestealer

    • Detects Acreed Stealer

    • Detects HijackLoader (aka IDAT Loader)

    • Family: Acreed

      Acreed is an information stealer.

      stealeracreed

    • Family: HijackLoader, IDAT loader, Ghostulse,

      HijackLoader is a multi-stage loader, first seen in 2023.

      loaderhijackloader

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks