Overview

overview

10

Static

static

3

a96eba1bb6...18.exe

windows7-x64

10

a96eba1bb6...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a96eba1bb6d8f4a75e515ba5fc4d22ee_JaffaCakes118

  • Size

    332KB

  • Sample

    240819-d6zftswblj

  • MD5

    a96eba1bb6d8f4a75e515ba5fc4d22ee

  • SHA1

    e342bad20ae1033e62ab00f1521c9e64b4759a0d

  • SHA256

    e07918d890c84920b2c25c01bbd6e657b360a6273225220d90e7ad8914030836

  • SHA512

    1d08357c80328ed917a78223872ab7ffdf60cb8b4698f59ced12273dd6bc34abb6e83fafe150df0ad5257d31e5da26f7c86183d0f4cd2f3331b290dfa12a22a9

  • SSDEEP

    6144:qcZ2x7wpsMF2uqQ0wxD+i5LF9K4KGZjncRhKuu2NxcO0/:G2wQLxDNZFRZQKuuED0

Score
10/10
isrstealerbootkitdiscoverypersistencespywarestealertrojan

Malware Config

Targets

    • Target

      a96eba1bb6d8f4a75e515ba5fc4d22ee_JaffaCakes118

    • Size

      332KB

    • MD5

      a96eba1bb6d8f4a75e515ba5fc4d22ee

    • SHA1

      e342bad20ae1033e62ab00f1521c9e64b4759a0d

    • SHA256

      e07918d890c84920b2c25c01bbd6e657b360a6273225220d90e7ad8914030836

    • SHA512

      1d08357c80328ed917a78223872ab7ffdf60cb8b4698f59ced12273dd6bc34abb6e83fafe150df0ad5257d31e5da26f7c86183d0f4cd2f3331b290dfa12a22a9

    • SSDEEP

      6144:qcZ2x7wpsMF2uqQ0wxD+i5LF9K4KGZjncRhKuu2NxcO0/:G2wQLxDNZFRZQKuuED0

    Score
    10/10
    isrstealerbootkitdiscoverypersistencespywarestealertrojan

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks