isrstealer | 89ec5d0f968479ce1cec3e7ed31bf5de92dec4101754a6e27660416bb39d32a5 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

edeb05bbb7...18.exe

windows7-x64

edeb05bbb7...18.exe

windows10-2004-x64

Sharing

General

Target

edeb05bbb74861fae1d5a5825fa6983b_JaffaCakes118
Size

224KB
Sample

240920-s8gq5avcrk
MD5

edeb05bbb74861fae1d5a5825fa6983b
SHA1

1a0e67f666c48d7fecf471132c028b94e7adf9ea
SHA256

89ec5d0f968479ce1cec3e7ed31bf5de92dec4101754a6e27660416bb39d32a5
SHA512

72c223b261e964059507ea8a648d339b9c6e1acb6aa9aad7a82b44e1d0ee7e2449681fe867a362c35cabadf37228b255a13b78baddab087a4331f8a9e46f032c
SSDEEP

3072:d8lk0HvEKFZsDK8auN2Kfji9vCXwFZxzsMaDuyIX4NqIYTDQgfc+lNTFCuNiV39q:dQHvVEKeQBT4N6yIX4N9Y90+ldF/NiV

Score

10^/10

isrstealer bootkit discovery persistence spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

edeb05bbb74861fae1d5a5825fa6983b_JaffaCakes118.exe

Resource

win7-20240903-en

isrstealer bootkit discovery persistence spyware stealer trojan

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

edeb05bbb74861fae1d5a5825fa6983b_JaffaCakes118.exe

Resource

win10v2004-20240802-en

isrstealer bootkit discovery persistence spyware stealer trojan

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  edeb05bbb74861fae1d5a5825fa6983b_JaffaCakes118
- Size
  
  224KB
- MD5
  
  edeb05bbb74861fae1d5a5825fa6983b
- SHA1
  
  1a0e67f666c48d7fecf471132c028b94e7adf9ea
- SHA256
  
  89ec5d0f968479ce1cec3e7ed31bf5de92dec4101754a6e27660416bb39d32a5
- SHA512
  
  72c223b261e964059507ea8a648d339b9c6e1acb6aa9aad7a82b44e1d0ee7e2449681fe867a362c35cabadf37228b255a13b78baddab087a4331f8a9e46f032c
- SSDEEP
  
  3072:d8lk0HvEKFZsDK8auN2Kfji9vCXwFZxzsMaDuyIX4NqIYTDQgfc+lNTFCuNiV39q:dQHvVEKeQBT4N6yIX4N9Y90+ldF/NiV
Score

10^/10

isrstealer bootkit discovery persistence spyware stealer trojan
- ISR Stealer
  ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
  trojan stealer isrstealer
- ISR Stealer payload
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Pre-OS Boot

Bootkit

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

isrstealerbootkitdiscoverypersistencespywarestealertrojan

behavioral2

isrstealerbootkitdiscoverypersistencespywarestealertrojan

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.