Overview

overview

10

Static

static

3

b7b32445d7...18.exe

windows7-x64

10

b7b32445d7...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b7b32445d7ad6970d602976d2170fc94_JaffaCakes118

  • Size

    3.0MB

  • Sample

    240822-p2j15axfqa

  • MD5

    b7b32445d7ad6970d602976d2170fc94

  • SHA1

    20485f3d9424523002ba12ed577119f5a04e84b5

  • SHA256

    29fb77bcf3c1c1f3ef186c63bb12c559304037364b091b7ad521f34fc4bb669b

  • SHA512

    a99f723cedf21823da9b394ca0fedf0c4da1c0721280f1ce99f49fc0f8adc423eef2cab90c14b7bc0fac551c4233735d53a941d287b0bc71faf616c9c79f9f25

  • SSDEEP

    98304:3Vy0GIKJmXXEf8mf50XYZsYdzSth0HZD1:iHqXY/GtOZ5

Score
10/10
isrstealerdiscoverystealertrojan

Malware Config

Targets

    • Target

      b7b32445d7ad6970d602976d2170fc94_JaffaCakes118

    • Size

      3.0MB

    • MD5

      b7b32445d7ad6970d602976d2170fc94

    • SHA1

      20485f3d9424523002ba12ed577119f5a04e84b5

    • SHA256

      29fb77bcf3c1c1f3ef186c63bb12c559304037364b091b7ad521f34fc4bb669b

    • SHA512

      a99f723cedf21823da9b394ca0fedf0c4da1c0721280f1ce99f49fc0f8adc423eef2cab90c14b7bc0fac551c4233735d53a941d287b0bc71faf616c9c79f9f25

    • SSDEEP

      98304:3Vy0GIKJmXXEf8mf50XYZsYdzSth0HZD1:iHqXY/GtOZ5

    Score
    10/10
    isrstealerdiscoverystealertrojan

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks