General
-
Target
JaffaCakes118_6bee3391e37c6e0715fbbae6a71de790
-
Size
522KB
-
Sample
250103-mca1taykgt
-
MD5
6bee3391e37c6e0715fbbae6a71de790
-
SHA1
f8fc14887d13a9df24558d3cc927d420d3fa36d5
-
SHA256
efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a
-
SHA512
cc2e5cb0dfc28c3f75db938535962b67b96c2ffd8d1a1ea14d97f3790c84d844ed17b064722308edefe539f376ba556b3beb5660f4dda5e2551662a948027a2b
-
SSDEEP
12288:i6kHB9C+9s3WRQukIyYZcEzVzl4b4M05KxdlEGHuXmtbsL:q9sc2Ayq8001E6o
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_6bee3391e37c6e0715fbbae6a71de790.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_6bee3391e37c6e0715fbbae6a71de790.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
JaffaCakes118_6bee3391e37c6e0715fbbae6a71de790
-
Size
522KB
-
MD5
6bee3391e37c6e0715fbbae6a71de790
-
SHA1
f8fc14887d13a9df24558d3cc927d420d3fa36d5
-
SHA256
efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a
-
SHA512
cc2e5cb0dfc28c3f75db938535962b67b96c2ffd8d1a1ea14d97f3790c84d844ed17b064722308edefe539f376ba556b3beb5660f4dda5e2551662a948027a2b
-
SSDEEP
12288:i6kHB9C+9s3WRQukIyYZcEzVzl4b4M05KxdlEGHuXmtbsL:q9sc2Ayq8001E6o
-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload
-
Isrstealer family
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft MailPassView
Password recovery tool for various email clients
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook accounts
-
Suspicious use of SetThreadContext
-