General
-
Target
JaffaCakes118_7b8ca19e8b7133aa8de06bc67e686330
-
Size
389KB
-
Sample
250104-yy3hqsxkgp
-
MD5
7b8ca19e8b7133aa8de06bc67e686330
-
SHA1
f347e1868be50a71042d9498955bc9ce48fef47a
-
SHA256
3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469b
-
SHA512
b4fd99b080d780d127e9384b52f78e309a4efd38aaa870f8fb52ca896db4c3c12cc581aac11a75ff8de8ddade43dffc76e38b99b8623fbda906bfcb637d6de62
-
SSDEEP
6144:JtEVpyJD+zjjSKDCmSam8xOPC4sOwMrSWtDYR3x0/9Yz1i:JtEVpyJyzjjJ4aBmCQr50uF
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_7b8ca19e8b7133aa8de06bc67e686330.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_7b8ca19e8b7133aa8de06bc67e686330.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
JaffaCakes118_7b8ca19e8b7133aa8de06bc67e686330
-
Size
389KB
-
MD5
7b8ca19e8b7133aa8de06bc67e686330
-
SHA1
f347e1868be50a71042d9498955bc9ce48fef47a
-
SHA256
3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469b
-
SHA512
b4fd99b080d780d127e9384b52f78e309a4efd38aaa870f8fb52ca896db4c3c12cc581aac11a75ff8de8ddade43dffc76e38b99b8623fbda906bfcb637d6de62
-
SSDEEP
6144:JtEVpyJD+zjjSKDCmSam8xOPC4sOwMrSWtDYR3x0/9Yz1i:JtEVpyJyzjjJ4aBmCQr50uF
-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload
-
Isrstealer family
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft MailPassView
Password recovery tool for various email clients
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook accounts
-
Suspicious use of SetThreadContext
-