Overview

overview

10

Static

static

3

afe792e92c...18.exe

windows7-x64

10

afe792e92c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    afe792e92c8def79c88d16479c8f9051_JaffaCakes118

  • Size

    364KB

  • Sample

    241129-jwh9razkhn

  • MD5

    afe792e92c8def79c88d16479c8f9051

  • SHA1

    c7ba86acd3435e4242092e607f4007ffe7f8cef5

  • SHA256

    e9bc6d9a2f1beee9a1bc7cd7a5f244fd72f4bececf7799f8b3788491aacee67a

  • SHA512

    0440b9aeacd9718c7f6e277cfb095e7bcf698159fe505863f878c61b00e308a7ec2421660227e7e11c14d1f0d97379ba87a1b4fe2ede50d9cfb4031a8db34da1

  • SSDEEP

    6144:vdBavOW+2/czOW+2/cxsgz3qm5N7cjh6lHSkJrcOR63mFi9gYR73:vdBavVcDVcjz3/86tAOgiuXb

Score
10/10
isrstealerdiscoveryevasionstealertrojan

Malware Config

Targets

    • Target

      afe792e92c8def79c88d16479c8f9051_JaffaCakes118

    • Size

      364KB

    • MD5

      afe792e92c8def79c88d16479c8f9051

    • SHA1

      c7ba86acd3435e4242092e607f4007ffe7f8cef5

    • SHA256

      e9bc6d9a2f1beee9a1bc7cd7a5f244fd72f4bececf7799f8b3788491aacee67a

    • SHA512

      0440b9aeacd9718c7f6e277cfb095e7bcf698159fe505863f878c61b00e308a7ec2421660227e7e11c14d1f0d97379ba87a1b4fe2ede50d9cfb4031a8db34da1

    • SSDEEP

      6144:vdBavOW+2/czOW+2/cxsgz3qm5N7cjh6lHSkJrcOR63mFi9gYR73:vdBavVcDVcjz3/86tAOgiuXb

    Score
    10/10
    isrstealerdiscoveryevasionstealertrojan

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Isrstealer family

      isrstealer

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks