General

  • Target

    26148b8e4595061e7716246a926c2eed_JaffaCakes118

  • Size

    946KB

  • Sample

    241008-1w3f3a1djm

  • MD5

    26148b8e4595061e7716246a926c2eed

  • SHA1

    1a61f0eea11b5cade43f03aea8eda112ee23480c

  • SHA256

    31f9e2b98f96265b9f0b50baa0745dd88077b0a1c3adeb4047d66a6fe801e1a3

  • SHA512

    98eaf519c6d069f9bbeb6c4b71a87dca4a8fbf6ed77bda73280f2187c64d148af633a5c4ed0ce11e7ffba4c04e8c1796e42c0b9ba1232733b8f32869f1f5f7a7

  • SSDEEP

    12288:6aWzgMg7v3qnCiMErQohh0F4CCJ8lny/QLway9wv+U4iG+D:1aHMv6Corjqny/QLE91FiP

Malware Config

Targets

    • Target

      26148b8e4595061e7716246a926c2eed_JaffaCakes118

    • Size

      946KB

    • MD5

      26148b8e4595061e7716246a926c2eed

    • SHA1

      1a61f0eea11b5cade43f03aea8eda112ee23480c

    • SHA256

      31f9e2b98f96265b9f0b50baa0745dd88077b0a1c3adeb4047d66a6fe801e1a3

    • SHA512

      98eaf519c6d069f9bbeb6c4b71a87dca4a8fbf6ed77bda73280f2187c64d148af633a5c4ed0ce11e7ffba4c04e8c1796e42c0b9ba1232733b8f32869f1f5f7a7

    • SSDEEP

      12288:6aWzgMg7v3qnCiMErQohh0F4CCJ8lny/QLway9wv+U4iG+D:1aHMv6Corjqny/QLE91FiP

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

    • ISR Stealer payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v15

Tasks