Overview

overview

10

Static

static

3

9fc95f4507...18.exe

windows7-x64

10

9fc95f4507...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9fc95f450783f79da496db9587c68117_JaffaCakes118

  • Size

    4.2MB

  • Sample

    240816-y3ra9sybmq

  • MD5

    9fc95f450783f79da496db9587c68117

  • SHA1

    4e5f2cd374b859c0e4566ce1e01e775fc8dc335a

  • SHA256

    b23acf005a8a6e43de88cf2420811535d9ad68a9ca03a29f82f9ffcc3a1861e2

  • SHA512

    6cf639d1efea8202837c8e2470df6c3234076465c340155f226a91108586828ceb3a5f30af9f784c5957b9eccc8a99c68ed339d35707882c6b3e63490f3e5ab5

  • SSDEEP

    6144:7/m9kF4LhB959Ak24Fa8yVRasuSuvfQ1dskAsaJraBCDorAB:bfFWB9bpFatVMPfgsVpraB

Score
10/10
isrstealercredential_accessdiscoverystealertrojanupx

Malware Config

Targets

    • Target

      9fc95f450783f79da496db9587c68117_JaffaCakes118

    • Size

      4.2MB

    • MD5

      9fc95f450783f79da496db9587c68117

    • SHA1

      4e5f2cd374b859c0e4566ce1e01e775fc8dc335a

    • SHA256

      b23acf005a8a6e43de88cf2420811535d9ad68a9ca03a29f82f9ffcc3a1861e2

    • SHA512

      6cf639d1efea8202837c8e2470df6c3234076465c340155f226a91108586828ceb3a5f30af9f784c5957b9eccc8a99c68ed339d35707882c6b3e63490f3e5ab5

    • SSDEEP

      6144:7/m9kF4LhB959Ak24Fa8yVRasuSuvfQ1dskAsaJraBCDorAB:bfFWB9bpFatVMPfgsVpraB

    Score
    10/10
    isrstealercredential_accessdiscoverystealertrojanupx

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks