isrstealer | ccf736f7cd9a9e92db675dbb7dc1ba47ec8332c078eea343e0877184f87d7fcd | Triage

Submit
Reports

Overview

overview

Static

static

3

c6906c96df...18.exe

windows7-x64

c6906c96df...18.exe

windows10-2004-x64

Sharing

General

Target

c6906c96dff316f1a2525980ccad5fdd_JaffaCakes118
Size

595KB
Sample

240828-k6dmpasfjg
MD5

c6906c96dff316f1a2525980ccad5fdd
SHA1

9becb7009df39331a7c693c871d6e2c5bd28e805
SHA256

ccf736f7cd9a9e92db675dbb7dc1ba47ec8332c078eea343e0877184f87d7fcd
SHA512

fcebbbdd08260c8d6b47f9e614157c190bfbb8de36b59614e79708e5f5e0b9e7c75f9fecb489a2fe4b93edbb733ec4bcaa1caa738265263aa0a91ede601faf7f
SSDEEP

6144:n2VZSbjwUhFZxfEtncaHvcl1gTfy7X2dIffr0uo3Jp5w2Cc+oifzUmkRPYaC:nkGbzrW0/GOfIuK5w2zhh1RPY

Score

10^/10

isrstealer credential_access discovery spyware stealer trojan upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

c6906c96dff316f1a2525980ccad5fdd_JaffaCakes118.exe

Resource

win7-20240704-en

isrstealer credential_access discovery spyware stealer trojan upx

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

c6906c96dff316f1a2525980ccad5fdd_JaffaCakes118.exe

Resource

win10v2004-20240802-en

isrstealer credential_access discovery spyware stealer trojan upx

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  c6906c96dff316f1a2525980ccad5fdd_JaffaCakes118
- Size
  
  595KB
- MD5
  
  c6906c96dff316f1a2525980ccad5fdd
- SHA1
  
  9becb7009df39331a7c693c871d6e2c5bd28e805
- SHA256
  
  ccf736f7cd9a9e92db675dbb7dc1ba47ec8332c078eea343e0877184f87d7fcd
- SHA512
  
  fcebbbdd08260c8d6b47f9e614157c190bfbb8de36b59614e79708e5f5e0b9e7c75f9fecb489a2fe4b93edbb733ec4bcaa1caa738265263aa0a91ede601faf7f
- SSDEEP
  
  6144:n2VZSbjwUhFZxfEtncaHvcl1gTfy7X2dIffr0uo3Jp5w2Cc+oifzUmkRPYaC:nkGbzrW0/GOfIuK5w2zhh1RPY
Score

10^/10

isrstealer credential_access discovery spyware stealer trojan upx
- ISR Stealer
  ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
  trojan stealer isrstealer
- ISR Stealer payload
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

isrstealercredential_accessdiscoveryspywarestealertrojanupx

behavioral2

isrstealercredential_accessdiscoveryspywarestealertrojanupx

© 2018-2025

Terms | Privacy