Overview

overview

10

Static

static

3

JaffaCakes...20.exe

windows7-x64

10

JaffaCakes...20.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_639a4d1d6ca2c2f4bd724742623d6b20

  • Size

    339KB

  • Sample

    250102-jmhlvstqfp

  • MD5

    639a4d1d6ca2c2f4bd724742623d6b20

  • SHA1

    43fbadcd3449f5d5d58d2e327ca0469444460a69

  • SHA256

    1f98317dbaa020e41fbe16381ee94d8e11ef088f0fac3a44f788fe78f66c7418

  • SHA512

    0734be9b90409b2395de6737c5dc0b44fe7b3b8058d8bf3788bf3833ae447159e0241c61a224a1f3145e81b33d25e17bc99f19d94b622871a4cf4fe522c3ca5a

  • SSDEEP

    6144:83ZN/pQ437RzShx9BsxsoalSnEe9aKeVfZh7IMtzr1+dd/Z7zAinpoSg7vIV:MZNf7R4xbBoSSn39aKeV/BJ+VQinKrgV

Score
10/10
isrstealercollectiondiscoveryspywarestealertrojanupx

Malware Config

Targets

    • Target

      JaffaCakes118_639a4d1d6ca2c2f4bd724742623d6b20

    • Size

      339KB

    • MD5

      639a4d1d6ca2c2f4bd724742623d6b20

    • SHA1

      43fbadcd3449f5d5d58d2e327ca0469444460a69

    • SHA256

      1f98317dbaa020e41fbe16381ee94d8e11ef088f0fac3a44f788fe78f66c7418

    • SHA512

      0734be9b90409b2395de6737c5dc0b44fe7b3b8058d8bf3788bf3833ae447159e0241c61a224a1f3145e81b33d25e17bc99f19d94b622871a4cf4fe522c3ca5a

    • SSDEEP

      6144:83ZN/pQ437RzShx9BsxsoalSnEe9aKeVfZh7IMtzr1+dd/Z7zAinpoSg7vIV:MZNf7R4xbBoSSn39aKeV/BJ+VQinKrgV

    Score
    10/10
    isrstealercollectiondiscoveryspywarestealertrojanupx

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Isrstealer family

      isrstealer

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks