Overview

overview

10

Static

static

3

JaffaCakes...81.exe

windows7-x64

10

JaffaCakes...81.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_7a50c281feea0a42e92925197fd9bd81

  • Size

    349KB

  • Sample

    250104-sbjjfstqev

  • MD5

    7a50c281feea0a42e92925197fd9bd81

  • SHA1

    130254f2739501ad83e04c02899c7ea9b2eca81f

  • SHA256

    4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66

  • SHA512

    1e8d6cb485aa169e7405ffb88dcef35b6443b0f1f43f4927fbb7f2719af1bfd04213f7e90ad48405f2dd2675cc19b7880101ef3b28e3aacbd6c71efb78822456

  • SSDEEP

    6144:ybkHQbHl7cxAOheBuI17jCmnrXculxMgtg9A8zv9i1Qo96l6OB+knYru89x275yh:ybk+7uAOgQI5G4xxHm9AOv9iSo99S+Mw

Score
10/10
isrstealercollectiondiscoverypersistencespywarestealertrojanupx

Malware Config

Targets

    • Target

      JaffaCakes118_7a50c281feea0a42e92925197fd9bd81

    • Size

      349KB

    • MD5

      7a50c281feea0a42e92925197fd9bd81

    • SHA1

      130254f2739501ad83e04c02899c7ea9b2eca81f

    • SHA256

      4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66

    • SHA512

      1e8d6cb485aa169e7405ffb88dcef35b6443b0f1f43f4927fbb7f2719af1bfd04213f7e90ad48405f2dd2675cc19b7880101ef3b28e3aacbd6c71efb78822456

    • SSDEEP

      6144:ybkHQbHl7cxAOheBuI17jCmnrXculxMgtg9A8zv9i1Qo96l6OB+knYru89x275yh:ybk+7uAOgQI5G4xxHm9AOv9iSo99S+Mw

    Score
    10/10
    isrstealercollectiondiscoverypersistencespywarestealertrojanupx

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Isrstealer family

      isrstealer

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks