Overview

overview

10

Static

static

3

a18c480c41...18.exe

windows7-x64

10

a18c480c41...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a18c480c41d516953efff7f43986ed64_JaffaCakes118

  • Size

    624KB

  • Sample

    240817-hf3ssasclg

  • MD5

    a18c480c41d516953efff7f43986ed64

  • SHA1

    1e799461932f0b364e82bd735c92628a2fc576de

  • SHA256

    4c17251d37a032e22b1ef9a36c5da8969cde628339d2a4e06c37a03fff24e6a6

  • SHA512

    1dcec2689d36386017f251fa9500f7092ca6a4f0f2c652217ab684bdd6d7c616920628e3bea7e9ece2996ad3befbaac3772ad2de1ee17ab7fe82a89991fac7cd

  • SSDEEP

    12288:3mEVUjGjo/xczqWm5blmISdTKbJsgu+khTUTCjL8DP:WEVUjoopd4dlWJtbccP

Score
10/10
isrstealerdiscoverystealertrojanupx

Malware Config

Targets

    • Target

      a18c480c41d516953efff7f43986ed64_JaffaCakes118

    • Size

      624KB

    • MD5

      a18c480c41d516953efff7f43986ed64

    • SHA1

      1e799461932f0b364e82bd735c92628a2fc576de

    • SHA256

      4c17251d37a032e22b1ef9a36c5da8969cde628339d2a4e06c37a03fff24e6a6

    • SHA512

      1dcec2689d36386017f251fa9500f7092ca6a4f0f2c652217ab684bdd6d7c616920628e3bea7e9ece2996ad3befbaac3772ad2de1ee17ab7fe82a89991fac7cd

    • SSDEEP

      12288:3mEVUjGjo/xczqWm5blmISdTKbJsgu+khTUTCjL8DP:WEVUjoopd4dlWJtbccP

    Score
    10/10
    isrstealerdiscoverystealertrojanupx

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks