General
-
Target
50810f392275b33d6976f10e9b1efb95_JaffaCakes118
-
Size
582KB
-
Sample
241017-ds2c9szcrb
-
MD5
50810f392275b33d6976f10e9b1efb95
-
SHA1
74988f4fa165ff5f3680a536e6d55f8fd47078bf
-
SHA256
c492121cfee1396777c5cef174cc3fee544ad57597f291d8ab5ce0b84bba991b
-
SHA512
2211ff032ea72be2c39ea9606420479a95179d951131066bb7a139aaff239c760deafb6cd12eabfd4d345995786d9120007b9e80fb3ccad5f97a282eace3e158
-
SSDEEP
12288:RPeyI5j1GSz0EeEvvjRI8khkyPegQttUp5e7:AprnzSCvtEDPpQjUM
Static task
static1
Behavioral task
behavioral1
Sample
50810f392275b33d6976f10e9b1efb95_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
50810f392275b33d6976f10e9b1efb95_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
50810f392275b33d6976f10e9b1efb95_JaffaCakes118
-
Size
582KB
-
MD5
50810f392275b33d6976f10e9b1efb95
-
SHA1
74988f4fa165ff5f3680a536e6d55f8fd47078bf
-
SHA256
c492121cfee1396777c5cef174cc3fee544ad57597f291d8ab5ce0b84bba991b
-
SHA512
2211ff032ea72be2c39ea9606420479a95179d951131066bb7a139aaff239c760deafb6cd12eabfd4d345995786d9120007b9e80fb3ccad5f97a282eace3e158
-
SSDEEP
12288:RPeyI5j1GSz0EeEvvjRI8khkyPegQttUp5e7:AprnzSCvtEDPpQjUM
-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft MailPassView
Password recovery tool for various email clients
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook accounts
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1