General

  • Target

    7e7f39c112ce5098605bc577064c7209_JaffaCakes118

  • Size

    444KB

  • Sample

    240801-akqp1swcmb

  • MD5

    7e7f39c112ce5098605bc577064c7209

  • SHA1

    0ab7663e868b19df78b98572d647d992da114800

  • SHA256

    b1b255b0810592adfeb0c17856548f055b5c392ea78c51c39d755670295a0e16

  • SHA512

    0c2d8bd4681ae4b088e6258a25f87e44e6905d48acf794b200bee709193d0f374c5821f9404e91888980a8e842f926d09f261f08cb3efd2bb90440e2f7d699f7

  • SSDEEP

    12288:/og8+JXeqnm+OzEFSVkjjQzQWYQBr78kfQO:/o+JXeqFTFSVLQVCAkz

Malware Config

Targets

    • Target

      7e7f39c112ce5098605bc577064c7209_JaffaCakes118

    • Size

      444KB

    • MD5

      7e7f39c112ce5098605bc577064c7209

    • SHA1

      0ab7663e868b19df78b98572d647d992da114800

    • SHA256

      b1b255b0810592adfeb0c17856548f055b5c392ea78c51c39d755670295a0e16

    • SHA512

      0c2d8bd4681ae4b088e6258a25f87e44e6905d48acf794b200bee709193d0f374c5821f9404e91888980a8e842f926d09f261f08cb3efd2bb90440e2f7d699f7

    • SSDEEP

      12288:/og8+JXeqnm+OzEFSVkjjQzQWYQBr78kfQO:/o+JXeqFTFSVLQVCAkz

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

    • ISR Stealer payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks