General

  • Target

    ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118

  • Size

    142KB

  • Sample

    240820-gv7jva1bjm

  • MD5

    ae2320bff3232e9fc1ac728c309f8996

  • SHA1

    71ad9e7edc551cd1c55da1150200e0807514b752

  • SHA256

    ebaa7eedd3afaffe68252eab2339114a9915f11e192f9a1f80b0ef74f88d984a

  • SHA512

    93a41a7020fc4fe72d6df8ec53792ad13e4346c916935ba278557c4a6d92f559286e6edef4d5c555f786cd33be47f8630ee7408203641bf3f1a8b5eb25434810

  • SSDEEP

    3072:pWxWYn2UHgK6aWzbAKjjOHXwCvzOvrns3T18wq21uOxhqk:ovH4aWzbRj8yrnGBjuO

Malware Config

Targets

    • Target

      ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118

    • Size

      142KB

    • MD5

      ae2320bff3232e9fc1ac728c309f8996

    • SHA1

      71ad9e7edc551cd1c55da1150200e0807514b752

    • SHA256

      ebaa7eedd3afaffe68252eab2339114a9915f11e192f9a1f80b0ef74f88d984a

    • SHA512

      93a41a7020fc4fe72d6df8ec53792ad13e4346c916935ba278557c4a6d92f559286e6edef4d5c555f786cd33be47f8630ee7408203641bf3f1a8b5eb25434810

    • SSDEEP

      3072:pWxWYn2UHgK6aWzbAKjjOHXwCvzOvrns3T18wq21uOxhqk:ovH4aWzbRj8yrnGBjuO

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

    • ISR Stealer payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks