Overview

overview

10

Static

static

10

e05a1a93cd...18.exe

windows7-x64

10

e05a1a93cd...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e05a1a93cd29737f4bd117d0e786e1bc_JaffaCakes118

  • Size

    265KB

  • Sample

    240914-rjsawsxgkj

  • MD5

    e05a1a93cd29737f4bd117d0e786e1bc

  • SHA1

    ab932c26fbbc1b4afa769ca6df09a0cdd55926eb

  • SHA256

    8f95a2a9ae1e0c859cec109b73a7384d117acfcd4da36762a47e6658ddf1ab49

  • SHA512

    6ba947b1393a83c4f6d6c0b72d3b19964b2d2869712ea0193b9f1b191cd0bad0c24e56403b430b3807571730faa4e7dc83200cda4b602704d3d71288e2a6ac28

  • SSDEEP

    6144:rSncRl+TqPRRdIKCC0ef//uXltKc+LVsz9b8:u4LdFeCXuLKcCVsz6

Score
10/10
isrstealercredential_accessdiscoveryspywarestealertrojanupx

Malware Config

Targets

    • Target

      e05a1a93cd29737f4bd117d0e786e1bc_JaffaCakes118

    • Size

      265KB

    • MD5

      e05a1a93cd29737f4bd117d0e786e1bc

    • SHA1

      ab932c26fbbc1b4afa769ca6df09a0cdd55926eb

    • SHA256

      8f95a2a9ae1e0c859cec109b73a7384d117acfcd4da36762a47e6658ddf1ab49

    • SHA512

      6ba947b1393a83c4f6d6c0b72d3b19964b2d2869712ea0193b9f1b191cd0bad0c24e56403b430b3807571730faa4e7dc83200cda4b602704d3d71288e2a6ac28

    • SSDEEP

      6144:rSncRl+TqPRRdIKCC0ef//uXltKc+LVsz9b8:u4LdFeCXuLKcCVsz6

    Score
    10/10
    isrstealercredential_accessdiscoveryspywarestealertrojanupx

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks