Overview

overview

10

Static

static

3

b8a0902264...18.exe

windows7-x64

10

b8a0902264...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b8a0902264c0e35b11085ac2e8222790_JaffaCakes118

  • Size

    620KB

  • Sample

    240822-wvtejstbqk

  • MD5

    b8a0902264c0e35b11085ac2e8222790

  • SHA1

    42eceb7e2fd9ab7f94ae7d9df84491416cf36bc7

  • SHA256

    242ba0418ae3e544594fae7e6e911a638fa26e2dbfedab47f2c58c004201dde6

  • SHA512

    e1237fac5d3754b469b54201bfff718abd7f661c2ae7135232ac174b5650fd7e6716f4cdef87e3098bcecb2309e64371e16559fec634ee2b71c3f66b1b8e4b83

  • SSDEEP

    12288:Y6kFDX8vJcK4T9ysNOr4AgzC2s46tIfEB9l9gBILCVG:NkFDMvv4ss0V6C2s4VfEB9l9gBw

Score
10/10
isrstealerbootkitdiscoverypersistencespywarestealertrojan

Malware Config

Targets

    • Target

      b8a0902264c0e35b11085ac2e8222790_JaffaCakes118

    • Size

      620KB

    • MD5

      b8a0902264c0e35b11085ac2e8222790

    • SHA1

      42eceb7e2fd9ab7f94ae7d9df84491416cf36bc7

    • SHA256

      242ba0418ae3e544594fae7e6e911a638fa26e2dbfedab47f2c58c004201dde6

    • SHA512

      e1237fac5d3754b469b54201bfff718abd7f661c2ae7135232ac174b5650fd7e6716f4cdef87e3098bcecb2309e64371e16559fec634ee2b71c3f66b1b8e4b83

    • SSDEEP

      12288:Y6kFDX8vJcK4T9ysNOr4AgzC2s46tIfEB9l9gBILCVG:NkFDMvv4ss0V6C2s4VfEB9l9gBw

    Score
    10/10
    isrstealerbootkitdiscoverypersistencespywarestealertrojan

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks