Overview

overview

10

Static

static

3

39ee717b40...18.exe

windows7-x64

10

39ee717b40...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    39ee717b40ae1f97060712436defe3fc_JaffaCakes118

  • Size

    688KB

  • Sample

    240711-t6a18svejp

  • MD5

    39ee717b40ae1f97060712436defe3fc

  • SHA1

    30d39a75d998758e3da9675c2152444839bebd1a

  • SHA256

    e0c8e81873372ffcddeac3f122725a66d552f293064bd8cc2d1573bc98556879

  • SHA512

    8c411359c3fe23164b514433e0213de6520517343246d2ab4dce345c5453f75bf4ac600e89fa729d5129cf31620bf92213db4b8f56e8e867b8c75b688f7c29b6

  • SSDEEP

    12288:XLXlW3Y0Jz6t6bFOcHDMJwqHdcouf8u2zxbdi06weZwd:zlyYsdDMDHdcouaxbd/xL

Score
10/10
isrstealerpersistencestealertrojanupx

Malware Config

Targets

    • Target

      39ee717b40ae1f97060712436defe3fc_JaffaCakes118

    • Size

      688KB

    • MD5

      39ee717b40ae1f97060712436defe3fc

    • SHA1

      30d39a75d998758e3da9675c2152444839bebd1a

    • SHA256

      e0c8e81873372ffcddeac3f122725a66d552f293064bd8cc2d1573bc98556879

    • SHA512

      8c411359c3fe23164b514433e0213de6520517343246d2ab4dce345c5453f75bf4ac600e89fa729d5129cf31620bf92213db4b8f56e8e867b8c75b688f7c29b6

    • SSDEEP

      12288:XLXlW3Y0Jz6t6bFOcHDMJwqHdcouf8u2zxbdi06weZwd:zlyYsdDMDHdcouaxbd/xL

    Score
    10/10
    isrstealerpersistencestealertrojanupx

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks