Overview

overview

10

Static

static

3

7723cd880e...18.exe

windows7-x64

10

7723cd880e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7723cd880e8c6fa9774b243da4ec1bdb_JaffaCakes118

  • Size

    388KB

  • Sample

    240727-fw2vbascna

  • MD5

    7723cd880e8c6fa9774b243da4ec1bdb

  • SHA1

    384170bbb8f68701d0b9a197b397e99758e014aa

  • SHA256

    59f0e3541fbf99774fcc96826f1fe8ad81611c782cc904b7d8c0568ba1a0698b

  • SHA512

    9767e94746eefa0abea68ca2b26fb8aaf573f5b7f6ac78bd176579896014409d9cd48735b6cc07ac4fbadca568bcd06217315f452803bba10efa3e63fabc5a5a

  • SSDEEP

    6144:8nBp3Xn2YSV6zG3KzkfqLp/cxFTWueDEPRf+1gSPuAaSAYPrhFCRf:Apa1KzkA/cxgutuPuhSAYThFCR

Score
10/10
isrstealerbootkitdiscoverypersistencespywarestealertrojan

Malware Config

Targets

    • Target

      7723cd880e8c6fa9774b243da4ec1bdb_JaffaCakes118

    • Size

      388KB

    • MD5

      7723cd880e8c6fa9774b243da4ec1bdb

    • SHA1

      384170bbb8f68701d0b9a197b397e99758e014aa

    • SHA256

      59f0e3541fbf99774fcc96826f1fe8ad81611c782cc904b7d8c0568ba1a0698b

    • SHA512

      9767e94746eefa0abea68ca2b26fb8aaf573f5b7f6ac78bd176579896014409d9cd48735b6cc07ac4fbadca568bcd06217315f452803bba10efa3e63fabc5a5a

    • SSDEEP

      6144:8nBp3Xn2YSV6zG3KzkfqLp/cxFTWueDEPRf+1gSPuAaSAYPrhFCRf:Apa1KzkA/cxgutuPuhSAYThFCR

    Score
    10/10
    isrstealerbootkitdiscoverypersistencespywarestealertrojan

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks