Overview

overview

10

Static

static

3

58e797d97c...18.exe

windows7-x64

10

58e797d97c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    58e797d97c447770b6b9d85e70cf9aca_JaffaCakes118

  • Size

    324KB

  • Sample

    241018-w6eqjasbjb

  • MD5

    58e797d97c447770b6b9d85e70cf9aca

  • SHA1

    ca425a27dd9f7edd66f579c871b3d1ff49efaa73

  • SHA256

    b1b5634d82b54f236ec950694065a46c7f3f7d381d747d9ef67cfff6db1de9bd

  • SHA512

    a26820aa51e157da5ee51e54e564f8f4c46c8e5610da3807f2038a2d830d56f36d02e9002cb7dca291dba99fd10b42afc137f7e1e23712ac4336a50c4e403edc

  • SSDEEP

    6144:yoY7yvft3kh+vIjazquDf02UebwfYSD3+AyqvGTX4ULqgqCRqWSc7:yo5vf6PEqC0ObeND3+AyC6GgbKs

Score
10/10
isrstealercollectiondiscoveryspywarestealertrojanupx

Malware Config

Targets

    • Target

      58e797d97c447770b6b9d85e70cf9aca_JaffaCakes118

    • Size

      324KB

    • MD5

      58e797d97c447770b6b9d85e70cf9aca

    • SHA1

      ca425a27dd9f7edd66f579c871b3d1ff49efaa73

    • SHA256

      b1b5634d82b54f236ec950694065a46c7f3f7d381d747d9ef67cfff6db1de9bd

    • SHA512

      a26820aa51e157da5ee51e54e564f8f4c46c8e5610da3807f2038a2d830d56f36d02e9002cb7dca291dba99fd10b42afc137f7e1e23712ac4336a50c4e403edc

    • SSDEEP

      6144:yoY7yvft3kh+vIjazquDf02UebwfYSD3+AyqvGTX4ULqgqCRqWSc7:yo5vf6PEqC0ObeND3+AyC6GgbKs

    Score
    10/10
    isrstealercollectiondiscoveryspywarestealertrojanupx

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks