General

  • Target

    93320a0361b12c7ecb0591b2bea5d04f_JaffaCakes118

  • Size

    252KB

  • Sample

    240813-qbrtqazckq

  • MD5

    93320a0361b12c7ecb0591b2bea5d04f

  • SHA1

    73b4b722249150a5cfb2d0318699eddb7a8f4224

  • SHA256

    3684a9fad5d69287ec4057b8d3ede2963b1a1a3b942c7581aa5fdb2a1bd52dcd

  • SHA512

    ae674722113579c89e0743618001483751bdf22a2f676981d7bee34f2e67497568a9b7b70149d62482ed4b89949e520846295ca5ad55a08b12b1e06707077f85

  • SSDEEP

    6144:vdOWSzH3MFiIN/rf+/4pWZjt6bhQ5srplZ55:vxSzH8UINjpWZjt6m8pn

Malware Config

Targets

    • Target

      93320a0361b12c7ecb0591b2bea5d04f_JaffaCakes118

    • Size

      252KB

    • MD5

      93320a0361b12c7ecb0591b2bea5d04f

    • SHA1

      73b4b722249150a5cfb2d0318699eddb7a8f4224

    • SHA256

      3684a9fad5d69287ec4057b8d3ede2963b1a1a3b942c7581aa5fdb2a1bd52dcd

    • SHA512

      ae674722113579c89e0743618001483751bdf22a2f676981d7bee34f2e67497568a9b7b70149d62482ed4b89949e520846295ca5ad55a08b12b1e06707077f85

    • SSDEEP

      6144:vdOWSzH3MFiIN/rf+/4pWZjt6bhQ5srplZ55:vxSzH8UINjpWZjt6m8pn

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

    • ISR Stealer payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks