Overview

overview

10

Static

static

3

1071976c73...18.exe

windows7-x64

10

1071976c73...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1071976c7372ca69ee12be54eaf5c8dc_JaffaCakes118

  • Size

    131KB

  • Sample

    240626-c342gazdke

  • MD5

    1071976c7372ca69ee12be54eaf5c8dc

  • SHA1

    2e18664e7590103b616aded9dbe4f9f61c6a6f49

  • SHA256

    5809a144d1acd6c9881b0c3cdf20d15628d4d0d8e56f252f7acf326bcfc921cf

  • SHA512

    120ae9546e575b2c30a20b46a831fd36b30282706a387037f18264aebf4f879c5c4fd0c8ccb81fcde6b0319bc256a7c005483368806463bbfe4476f9f28a6455

  • SSDEEP

    1536:pfwMnQ4JMtzAKDX1fVY2xT5R0cYhouL3rhHQt027revscd2GEyJ7DB0GtZ:5ua6CxWuTrhHy0SrlOEi7l0GtZ

Score
10/10
isrstealerspywarestealertrojan

Malware Config

Targets

    • Target

      1071976c7372ca69ee12be54eaf5c8dc_JaffaCakes118

    • Size

      131KB

    • MD5

      1071976c7372ca69ee12be54eaf5c8dc

    • SHA1

      2e18664e7590103b616aded9dbe4f9f61c6a6f49

    • SHA256

      5809a144d1acd6c9881b0c3cdf20d15628d4d0d8e56f252f7acf326bcfc921cf

    • SHA512

      120ae9546e575b2c30a20b46a831fd36b30282706a387037f18264aebf4f879c5c4fd0c8ccb81fcde6b0319bc256a7c005483368806463bbfe4476f9f28a6455

    • SSDEEP

      1536:pfwMnQ4JMtzAKDX1fVY2xT5R0cYhouL3rhHQt027revscd2GEyJ7DB0GtZ:5ua6CxWuTrhHy0SrlOEi7l0GtZ

    Score
    10/10
    isrstealerspywarestealertrojan

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks