Overview

overview

10

Static

static

3

12a0507a3f...18.exe

windows7-x64

10

12a0507a3f...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    12a0507a3fa1830c02af1155df5b17d4_JaffaCakes118

  • Size

    252KB

  • Sample

    240626-tt8rqsvfkr

  • MD5

    12a0507a3fa1830c02af1155df5b17d4

  • SHA1

    519b62b20ea54afb80db97d647d4f3450f5ff0b1

  • SHA256

    8c3b961b4f232f5ab2594f14e852467275271b63f28d76dc82ae68144d27e9d7

  • SHA512

    56ad8c31cd38b716a9468349b29a34231c806e8cb45979b49f4e6ea2037fc0a8e905ae49d3b32b989618ac16b668c424f916f53aba18db1fc5efc95f9952d5d6

  • SSDEEP

    6144:5nBp3Xn2AzbbbbbbbbbbbbbgW1hggvPTbbbbbbbbbbbbbbbbbbbbKPDFOlZeVtpU:/pXzbbbbbbbbbbbbbgW1hgg3Tbbbbbbs

Score
10/10
isrstealerbootkitpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      12a0507a3fa1830c02af1155df5b17d4_JaffaCakes118

    • Size

      252KB

    • MD5

      12a0507a3fa1830c02af1155df5b17d4

    • SHA1

      519b62b20ea54afb80db97d647d4f3450f5ff0b1

    • SHA256

      8c3b961b4f232f5ab2594f14e852467275271b63f28d76dc82ae68144d27e9d7

    • SHA512

      56ad8c31cd38b716a9468349b29a34231c806e8cb45979b49f4e6ea2037fc0a8e905ae49d3b32b989618ac16b668c424f916f53aba18db1fc5efc95f9952d5d6

    • SSDEEP

      6144:5nBp3Xn2AzbbbbbbbbbbbbbgW1hggvPTbbbbbbbbbbbbbbbbbbbbKPDFOlZeVtpU:/pXzbbbbbbbbbbbbbgW1hgg3Tbbbbbbs

    Score
    10/10
    isrstealerbootkitpersistencespywarestealertrojan

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks