Overview

overview

10

Static

static

3

14e8932dde...18.exe

windows7-x64

10

14e8932dde...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    14e8932ddeef02f04fbee516520cd5a4_JaffaCakes118

  • Size

    409KB

  • Sample

    241004-zvpm5s1amb

  • MD5

    14e8932ddeef02f04fbee516520cd5a4

  • SHA1

    a6db70376e93e9c3f9817f93ec8de83d0f546118

  • SHA256

    b1e37d19ea5557b754aacbde1d5576dfb19b066046e8985a12175ff01b5b815c

  • SHA512

    944e9baddaec4e129847e3f7d7faa4c2b28e2d5d4af54a40bed699017a8809636b865fb7765e4f4d69d27d5b9aa391886daa427d1421d7729fb3a61add2a3e96

  • SSDEEP

    6144:/CzvmyNV6J32nj3cb0TOJxijBIm8OC3/Q0eghkCDJLv7PlPcu2oEy4WXjYb4LDZT:abmqW2njU5J0jelY9gqkN7XI4LhEe

Score
10/10
isrstealerdiscoverystealertrojan

Malware Config

Targets

    • Target

      14e8932ddeef02f04fbee516520cd5a4_JaffaCakes118

    • Size

      409KB

    • MD5

      14e8932ddeef02f04fbee516520cd5a4

    • SHA1

      a6db70376e93e9c3f9817f93ec8de83d0f546118

    • SHA256

      b1e37d19ea5557b754aacbde1d5576dfb19b066046e8985a12175ff01b5b815c

    • SHA512

      944e9baddaec4e129847e3f7d7faa4c2b28e2d5d4af54a40bed699017a8809636b865fb7765e4f4d69d27d5b9aa391886daa427d1421d7729fb3a61add2a3e96

    • SSDEEP

      6144:/CzvmyNV6J32nj3cb0TOJxijBIm8OC3/Q0eghkCDJLv7PlPcu2oEy4WXjYb4LDZT:abmqW2njU5J0jelY9gqkN7XI4LhEe

    Score
    10/10
    isrstealerdiscoverystealertrojan

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks