Overview

overview

10

Static

static

3

bc900ec165...18.exe

windows7-x64

10

bc900ec165...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bc900ec165c7974d6b8a35003e8b469f_JaffaCakes118

  • Size

    248KB

  • Sample

    240823-vfqjnswfke

  • MD5

    bc900ec165c7974d6b8a35003e8b469f

  • SHA1

    2455fca46873fddc8e776278d931e4f86bea326d

  • SHA256

    93f2e07cc7722a22a158b71a0cc2a456f4fbdca5cfd67fa8e905e066522216f3

  • SHA512

    d8ecb449ce2e6489f345a29fdf9a8ab2d16fa5407310195f8e8dbf6590c0160417a054cc6e908badb0ade9c50cde33a503ffeb06121d12a83011b7fd0444d060

  • SSDEEP

    3072:hm+JmSCT1QEMQkrp8RCODSS2olEPKeMFxdK0NHhwCxzL5PKATEt1l8Hw3bImQQEj:8+6T6EMjpQDL20EP1MvwCIOH

Score
10/10
isrstealerdiscoverystealertrojan

Malware Config

Targets

    • Target

      bc900ec165c7974d6b8a35003e8b469f_JaffaCakes118

    • Size

      248KB

    • MD5

      bc900ec165c7974d6b8a35003e8b469f

    • SHA1

      2455fca46873fddc8e776278d931e4f86bea326d

    • SHA256

      93f2e07cc7722a22a158b71a0cc2a456f4fbdca5cfd67fa8e905e066522216f3

    • SHA512

      d8ecb449ce2e6489f345a29fdf9a8ab2d16fa5407310195f8e8dbf6590c0160417a054cc6e908badb0ade9c50cde33a503ffeb06121d12a83011b7fd0444d060

    • SSDEEP

      3072:hm+JmSCT1QEMQkrp8RCODSS2olEPKeMFxdK0NHhwCxzL5PKATEt1l8Hw3bImQQEj:8+6T6EMjpQDL20EP1MvwCIOH

    Score
    10/10
    isrstealerdiscoverystealertrojan

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks