Overview

overview

10

Static

static

7

51c48c7883...18.exe

windows7-x64

10

51c48c7883...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    51c48c7883996041dc09085e6c411cf5_JaffaCakes118

  • Size

    4.1MB

  • Sample

    240517-18tppaea97

  • MD5

    51c48c7883996041dc09085e6c411cf5

  • SHA1

    05b087ecc02d3c3c14335938477a2e89892f98af

  • SHA256

    d645b822e10ca959eea7043b304a63f29e4ce3b07a4db816cf6342464c4d8b53

  • SHA512

    73e032bd494b34f63d0745a5a186b5af2ea652f2d85ec11682ae597b7f857e410dc917ce41260b5fc9056bc2ff27ce17b9decde921b4cd53c6667c538ba9eac1

  • SSDEEP

    98304:3Qo9V+tPT2ZZOgPPaQM1sJ7yBxbnYVd+NOOgmcADNI09:3Qo9M52ZZOyaQMCJmBRn+d+NwAB

Score
10/10
fabookiepersistencespywarestealerupxvmprotect

Malware Config

Targets

    • Target

      51c48c7883996041dc09085e6c411cf5_JaffaCakes118

    • Size

      4.1MB

    • MD5

      51c48c7883996041dc09085e6c411cf5

    • SHA1

      05b087ecc02d3c3c14335938477a2e89892f98af

    • SHA256

      d645b822e10ca959eea7043b304a63f29e4ce3b07a4db816cf6342464c4d8b53

    • SHA512

      73e032bd494b34f63d0745a5a186b5af2ea652f2d85ec11682ae597b7f857e410dc917ce41260b5fc9056bc2ff27ce17b9decde921b4cd53c6667c538ba9eac1

    • SSDEEP

      98304:3Qo9V+tPT2ZZOgPPaQM1sJ7yBxbnYVd+NOOgmcADNI09:3Qo9M52ZZOyaQMCJmBRn+d+NwAB

    Score
    10/10
    fabookiepersistencespywarestealerupxvmprotect

    • Detect Fabookie payload

    • Fabookie

      Fabookie is facebook account info stealer.

      spywarestealerfabookie

    • Nirsoft

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks