Overview

overview

10

Static

static

3

09000000000000009.exe

windows7-x64

7

09000000000000009.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

7g26jn92p7b.dll

windows7-x64

6

7g26jn92p7b.dll

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    152a6b493e437da79167e1d04c9d8288_JaffaCakes118

  • Size

    727KB

  • Sample

    240627-jdyays1gnn

  • MD5

    152a6b493e437da79167e1d04c9d8288

  • SHA1

    7d889323d8f039b356a91b26d53d3a2956598571

  • SHA256

    78aa4ee141da64e2c2f154bf7f24fc6ad0c3ce4ec5847373eba02c3c0f85849e

  • SHA512

    347e6db837cd1f30dda28c37c504d0bfd5010822e5a6183c4750c01bc9a02bde634f2f738eacc547efdbaafe938a0a831abd15151e2d6462b3d2c144ac9214e8

  • SSDEEP

    12288:MfeIn+/4p1Zm50hu+uovzIaqo3quSKozC1hmxVQEuXzHcpUpakgroNQ:MfeQy4/ZmCu+uuxqSWzC1QxkrSUQproe

Score
10/10
massloggercollectionpersistencespywarestealer

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    ihemeg1986

Targets

    • Target

      09000000000000009.exe

    • Size

      741KB

    • MD5

      371f235c3625f124dee36379a46a8dba

    • SHA1

      23e1fcb3503ee740cdc67c8045e9b7c8c1babec8

    • SHA256

      ae1101f81ed495b405d0f80d678da0a6eff8e2f9c432734302ffb764b215de0a

    • SHA512

      a83c28b39989754ec3fd6d76ab55fcbf37a3b4fedb141962f8aa7fae7d1b681d5b95d9db0cd56025549f71d18b7748a9852f324e0c1a1d6fe4dba1bfd2431ebb

    • SSDEEP

      12288:ldCVE4Cn+bipNZmN0BueA63zIK48XqASE4zC1zmBVQEu9LPcfUdEkmrodF:jC9u8ifZmgueAGz4a6zC1UxoTQUa1ror

    Score
    10/10
    persistencemassloggercollectionspywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main payload

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      fccff8cb7a1067e23fd2e2b63971a8e1

    • SHA1

      30e2a9e137c1223a78a0f7b0bf96a1c361976d91

    • SHA256

      6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

    • SHA512

      f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

    • SSDEEP

      192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4

    Score
    3/10
    behavioral3behavioral4

    • Target

      7g26jn92p7b.dll

    • Size

      14KB

    • MD5

      d4cd2de76cb5e3926b6ebbdb5d421490

    • SHA1

      9ba8904ab672d5761ff95c7db07ca249d000b0d0

    • SHA256

      4feb8ae08b605e9cd75f5a999c59cdb5b5ddc5dd6932b018ba0a4fa5ef6dd1d5

    • SHA512

      7acb5f7d6d204779ed5c232d8e5fc01cd7312f59631a68bd10944b221f3e45b573cefa61e236d977ce623e9d99f3ed3c5b64a8086cc6c30bd648eaabc36126e5

    • SSDEEP

      192:5zfMvg35JT5CQuF9RFNDaSL6SwcuULPYABqo011nzxwSlTgMMXioI:5fM8JiF9RfaSL6SwuYV1FxwSJ9

    Score
    6/10
    persistence
    behavioral5behavioral6

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks