General

  • Target

    337e98501a057b1d83f757c8c21ef1c1_JaffaCakes118

  • Size

    204KB

  • Sample

    241011-gd7taatbkn

  • MD5

    337e98501a057b1d83f757c8c21ef1c1

  • SHA1

    d4afdd9550790d81a87538546c4ef7d2455cbdb2

  • SHA256

    0789d92055f61679e9f8975abeb60b5013a2a8b78027a6d488d35d4d97ad8c4a

  • SHA512

    ca903d11819866d3653fee85ea4a28316ef9b7d6126f2df4616f0294620e7b88f6358996decec6602556478dce1983c315df4ea5d670afe38e17ffce5cae3f76

  • SSDEEP

    3072:vCqC5dwMY7kI/1C+xkJQi+xFNfc55st2XwF1kUH9U7/jiNwGNILV2nBcNBW:vCPwMYgI/1C+xjy

Malware Config

Targets

    • Target

      337e98501a057b1d83f757c8c21ef1c1_JaffaCakes118

    • Size

      204KB

    • MD5

      337e98501a057b1d83f757c8c21ef1c1

    • SHA1

      d4afdd9550790d81a87538546c4ef7d2455cbdb2

    • SHA256

      0789d92055f61679e9f8975abeb60b5013a2a8b78027a6d488d35d4d97ad8c4a

    • SHA512

      ca903d11819866d3653fee85ea4a28316ef9b7d6126f2df4616f0294620e7b88f6358996decec6602556478dce1983c315df4ea5d670afe38e17ffce5cae3f76

    • SSDEEP

      3072:vCqC5dwMY7kI/1C+xkJQi+xFNfc55st2XwF1kUH9U7/jiNwGNILV2nBcNBW:vCPwMYgI/1C+xjy

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

    • ISR Stealer payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks