Overview

overview

10

Static

static

1

7007d18572...18.exe

windows7-x64

10

7007d18572...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7007d18572c698684034bfad2b362b89_JaffaCakes118

  • Size

    342KB

  • Sample

    241023-vzdn8a1hkg

  • MD5

    7007d18572c698684034bfad2b362b89

  • SHA1

    82465a723e7261d4c85453bcafa71e05e30ba7f1

  • SHA256

    81269b9ac377952e152d435a0befc327cf04e15b78e1864a117920314f268696

  • SHA512

    e95b2c6b3207d08c8f66e8185c409c2987e8bd7126950f100d7d81c831974e24504ad1ef7d765bf828bf440904107b10a4d93d263b6a9eac2b4c9a0c797c92fa

  • SSDEEP

    6144:ZUPVfXdXzazDKSw47JllSr28LNhsibjlaIuhT98ai2Q4I4TUvW+N:GPFdXGzDKvWJerhrCc2cgUvvN

Score
10/10
isrstealercollectiondiscoverypersistencespywarestealertrojanupx

Malware Config

Targets

    • Target

      7007d18572c698684034bfad2b362b89_JaffaCakes118

    • Size

      342KB

    • MD5

      7007d18572c698684034bfad2b362b89

    • SHA1

      82465a723e7261d4c85453bcafa71e05e30ba7f1

    • SHA256

      81269b9ac377952e152d435a0befc327cf04e15b78e1864a117920314f268696

    • SHA512

      e95b2c6b3207d08c8f66e8185c409c2987e8bd7126950f100d7d81c831974e24504ad1ef7d765bf828bf440904107b10a4d93d263b6a9eac2b4c9a0c797c92fa

    • SSDEEP

      6144:ZUPVfXdXzazDKSw47JllSr28LNhsibjlaIuhT98ai2Q4I4TUvW+N:GPFdXGzDKvWJerhrCc2cgUvvN

    Score
    10/10
    isrstealercollectiondiscoverypersistencespywarestealertrojanupx

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks