Overview

overview

10

Static

static

3

833c3ca181...18.exe

windows7-x64

10

833c3ca181...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    833c3ca181549d31374e60629f8aa233_JaffaCakes118

  • Size

    71KB

  • Sample

    240802-gb7qhayemn

  • MD5

    833c3ca181549d31374e60629f8aa233

  • SHA1

    607329a5788be132d872b0507645a149e19c5469

  • SHA256

    706b138c55d21ea056f38803a78091803c9d66e25d3a61e7c98612bca55ad929

  • SHA512

    2f950d1cd61fcf5f0a47eb6d96cbf13e3a183dd8546e1781ff08d6e394bc4646ee22d6255e97ebeb5ed89682b6eddda37f186602cbfe28a21fa9505d99f89d84

  • SSDEEP

    1536:cPiMIluN43I8eGKV4RF+R9ZaspCnKS29ch8FUPaBUogZ/5:cPTIP48eGKV5R9ZAnYS9PyC/5

Score
10/10
isrstealerdiscoveryspywarestealertrojan

Malware Config

Targets

    • Target

      833c3ca181549d31374e60629f8aa233_JaffaCakes118

    • Size

      71KB

    • MD5

      833c3ca181549d31374e60629f8aa233

    • SHA1

      607329a5788be132d872b0507645a149e19c5469

    • SHA256

      706b138c55d21ea056f38803a78091803c9d66e25d3a61e7c98612bca55ad929

    • SHA512

      2f950d1cd61fcf5f0a47eb6d96cbf13e3a183dd8546e1781ff08d6e394bc4646ee22d6255e97ebeb5ed89682b6eddda37f186602cbfe28a21fa9505d99f89d84

    • SSDEEP

      1536:cPiMIluN43I8eGKV4RF+R9ZaspCnKS29ch8FUPaBUogZ/5:cPTIP48eGKV5R9ZAnYS9PyC/5

    Score
    10/10
    isrstealerdiscoveryspywarestealertrojan

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks