Overview

overview

10

Static

static

3

c1cfb778cb...18.exe

windows7-x64

10

c1cfb778cb...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c1cfb778cbfe135b6fb0d2b6b9116b38_JaffaCakes118

  • Size

    156KB

  • Sample

    240825-3ememashrq

  • MD5

    c1cfb778cbfe135b6fb0d2b6b9116b38

  • SHA1

    f90af1a915f603a6acc40c18a5d9e8e6eef8d015

  • SHA256

    b5d32c93e9a815f775489aa2b0ab1f86d45821df344916237746557062d7e8fb

  • SHA512

    8ca72c995233c5c14eb9d1b6d6b1b70f72f03acbfb578743b0da8bce03b36d0d2d7e005feefb2fffd55f803e41f9e17b5be8ccc5a333a34d426545fbb6443b0a

  • SSDEEP

    3072:+rHi7npAaojNu3LTEj+XaUC3lgosmm8O3J7We5FaOVdD4uhepQ:38jCLT0Rr3+onm/39PRHMuhep

Score
10/10
isrstealerdiscoveryspywarestealertrojan

Malware Config

Targets

    • Target

      c1cfb778cbfe135b6fb0d2b6b9116b38_JaffaCakes118

    • Size

      156KB

    • MD5

      c1cfb778cbfe135b6fb0d2b6b9116b38

    • SHA1

      f90af1a915f603a6acc40c18a5d9e8e6eef8d015

    • SHA256

      b5d32c93e9a815f775489aa2b0ab1f86d45821df344916237746557062d7e8fb

    • SHA512

      8ca72c995233c5c14eb9d1b6d6b1b70f72f03acbfb578743b0da8bce03b36d0d2d7e005feefb2fffd55f803e41f9e17b5be8ccc5a333a34d426545fbb6443b0a

    • SSDEEP

      3072:+rHi7npAaojNu3LTEj+XaUC3lgosmm8O3J7We5FaOVdD4uhepQ:38jCLT0Rr3+onm/39PRHMuhep

    Score
    10/10
    isrstealerdiscoveryspywarestealertrojan

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks