General
-
Target
99e445a3b3a4c17256431acf01d34f2b_JaffaCakes118
-
Size
876KB
-
Sample
240815-mfpclssgrj
-
MD5
99e445a3b3a4c17256431acf01d34f2b
-
SHA1
129d2f8bb8f3a36e994fc99db6d24cb3b539834e
-
SHA256
933e73089907d9a6031dc117d40c29ead10553c135e050feda1e08a16dd49fab
-
SHA512
bcc908db17214e9e8979edc3c60e4283f6507d1f61a04b27c0642d6f75e8ba7b2acd0b5afee883fc92c87249d6908fa298ee1720090d05f604f7d3d856807449
-
SSDEEP
24576:Rd0jNhkIOUnBfeQtee2XgEi3GPYbYXd8Sa:/0jNh62I1+CfXd
Malware Config
Targets
-
-
Target
99e445a3b3a4c17256431acf01d34f2b_JaffaCakes118
-
Size
876KB
-
MD5
99e445a3b3a4c17256431acf01d34f2b
-
SHA1
129d2f8bb8f3a36e994fc99db6d24cb3b539834e
-
SHA256
933e73089907d9a6031dc117d40c29ead10553c135e050feda1e08a16dd49fab
-
SHA512
bcc908db17214e9e8979edc3c60e4283f6507d1f61a04b27c0642d6f75e8ba7b2acd0b5afee883fc92c87249d6908fa298ee1720090d05f604f7d3d856807449
-
SSDEEP
24576:Rd0jNhkIOUnBfeQtee2XgEi3GPYbYXd8Sa:/0jNh62I1+CfXd
Score10/10-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-