Overview

overview

10

Static

static

10

jaffacakes...e7.dll

windows10-2004-x64

8

jaffacakes...e7.dll

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    jaffacakes118_4b3ce65556d9974c94c673c105cabb5ef19743d69a03d7fb66fe9d0a365791e7.bin
  • Size 1.0MB
  • Sample260912-nc5qvsae72
  • SHA256 4b3ce65556d9974c94c673c105cabb5ef19743d69a03d7fb66fe9d0a365791e7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
amadeyc3450bcollectioncredential_accessdiscoveryexecutionpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Extracted

Family

  • amadey

Version

  • 5.04

Botnet

  • c3450b

C2

  • http://185.208.158.96

Attributes
  • strings_key

    b032f23912454b9cac163491e8668481

  • url_paths

    /mzmtrpwoe113eelxn/index.php

rc4.plain

Targets

    • Target
      jaffacakes118_4b3ce65556d9974c94c673c105cabb5ef19743d69a03d7fb66fe9d0a365791e7.bin
    • Size 1.0MB
    • SHA256 4b3ce65556d9974c94c673c105cabb5ef19743d69a03d7fb66fe9d0a365791e7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    collectioncredential_accessdiscoveryexecutionpersistenceprivilege_escalationspywarestealer

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook profiles

      collection
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

4
T1552

Credentials In Files

3
T1552.001

Credentials in Registry

1
T1552.002

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Wi-Fi Discovery

1
T1016.002

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Command and Control

Exfiltration

Impact

Tasks