Overview

overview

10

Static

static

3

FaceDominator.exe

windows7-x64

10

FaceDominator.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bdf7b393a72f5243bab5fdd561e35e18_JaffaCakes118

  • Size

    541KB

  • Sample

    240824-f3ctrsxamn

  • MD5

    bdf7b393a72f5243bab5fdd561e35e18

  • SHA1

    a05edc8fa6fd1ffefbd150ecb700b63eae7c29ac

  • SHA256

    f16bba5611c925cf12c428b437df35899ed1874f0c95f6180e99679f503a3e40

  • SHA512

    cf785c58ce6fa03c80e2125bb363762f18d82d010566412340c5e0ac377b0fc4c77ac9e2c3a57f4f3fc7b38a0131cea5485f9f8c2aa76f3706d37140c56c2a85

  • SSDEEP

    12288:bNmUI3LI/4dosouzKrZxwW9etsAU4Hh/7cRZ:b7Is/4WstKRYtsiHhC

Score
10/10
isrstealercredential_accessdiscoveryspywarestealertrojanupx

Malware Config

Targets

    • Target

      FaceDominator.exe

    • Size

      1.0MB

    • MD5

      53c80c314eb143d4bf9b36a1e977fc54

    • SHA1

      b4eaff640332e3708582e5e786b2f5c869fd84c1

    • SHA256

      53565b6cb4bce84116a60b28a4470c470c6863789178cd7df2c9bb9835c475f8

    • SHA512

      74ae5086a40a93d4b205c4b86978eb53b9e26412740efa7925ca89a5b2622fbb712de42cd9f9b22d6a069d185059587f822962fa2fb0991d0fe3637e03488d9e

    • SSDEEP

      12288:8WqmWmaL0X4Y0Ig9MhL2Oo+5N0MJFAgljfWNh2Zkq35XoLvJgIVn+u6Bw8Dha5uH:aBt0L0Ig9MVjo+5NXnkh2TAJgIaa0

    Score
    10/10
    isrstealercredential_accessdiscoveryspywarestealertrojanupx

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks