Overview

overview

10

Static

static

3

66b852a9c9...18.exe

windows7-x64

10

66b852a9c9...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    66b852a9c91b240e80f7e59bab108298_JaffaCakes118

  • Size

    247KB

  • Sample

    240723-jnhy1swcjm

  • MD5

    66b852a9c91b240e80f7e59bab108298

  • SHA1

    9accc7f379bf198237835fa7d58c299cee47f7cf

  • SHA256

    cf7e2983b8fef5a9588080285389d57a5f6b738ca2f00639a8edebf2ee473835

  • SHA512

    3e3b5623518101d49b41118cdcba2d694e8d73ff683adaf763372b1a4b29e9848ab5da1b5c1ec804bde61f195a1cca4e76c435a334619d88b56776b671f243c8

  • SSDEEP

    3072:Y7tfvw/idrxY5reRd1sSPwD/lPALbIiuS:tiJxgeRd1sSPQiu

Score
10/10
isrstealerpersistencestealertrojan

Malware Config

Targets

    • Target

      66b852a9c91b240e80f7e59bab108298_JaffaCakes118

    • Size

      247KB

    • MD5

      66b852a9c91b240e80f7e59bab108298

    • SHA1

      9accc7f379bf198237835fa7d58c299cee47f7cf

    • SHA256

      cf7e2983b8fef5a9588080285389d57a5f6b738ca2f00639a8edebf2ee473835

    • SHA512

      3e3b5623518101d49b41118cdcba2d694e8d73ff683adaf763372b1a4b29e9848ab5da1b5c1ec804bde61f195a1cca4e76c435a334619d88b56776b671f243c8

    • SSDEEP

      3072:Y7tfvw/idrxY5reRd1sSPwD/lPALbIiuS:tiJxgeRd1sSPQiu

    Score
    10/10
    isrstealerpersistencestealertrojan

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks