Overview

overview

10

Static

static

3

65721901b8...18.exe

windows7-x64

10

65721901b8...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    65721901b8c5c8ca042861c1e5ec007f_JaffaCakes118

  • Size

    4.1MB

  • Sample

    240723-axvvhaxcmh

  • MD5

    65721901b8c5c8ca042861c1e5ec007f

  • SHA1

    074f1d0f378228e785590d7a628b398282c1285b

  • SHA256

    2c88469023eab87ea72ca237b159f09c0d1fa314b26706fa7164f6edceb179c7

  • SHA512

    d0c3aff70ed7fc79a6680c11a3a9bd92cfa4b8f7cf804ee14901f3fbe5dbe726ad00d774a970e196f41187ec8fb02f293a57de3e5ada5e727ff19efd141181c0

  • SSDEEP

    6144:7/m9kF4LhB959Ak24Fa8yVRasuSuvfQ1dskAsaJraBCDorAB:bfFWB9bpFatVMPfgsVpraB

Score
10/10
isrstealerstealertrojanupx

Malware Config

Targets

    • Target

      65721901b8c5c8ca042861c1e5ec007f_JaffaCakes118

    • Size

      4.1MB

    • MD5

      65721901b8c5c8ca042861c1e5ec007f

    • SHA1

      074f1d0f378228e785590d7a628b398282c1285b

    • SHA256

      2c88469023eab87ea72ca237b159f09c0d1fa314b26706fa7164f6edceb179c7

    • SHA512

      d0c3aff70ed7fc79a6680c11a3a9bd92cfa4b8f7cf804ee14901f3fbe5dbe726ad00d774a970e196f41187ec8fb02f293a57de3e5ada5e727ff19efd141181c0

    • SSDEEP

      6144:7/m9kF4LhB959Ak24Fa8yVRasuSuvfQ1dskAsaJraBCDorAB:bfFWB9bpFatVMPfgsVpraB

    Score
    10/10
    isrstealerstealertrojanupx

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks