Overview

overview

10

Static

static

3

JaffaCakes...7f.exe

windows7-x64

10

JaffaCakes...7f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_4c31ea31113e35d75360f31d5677527f

  • Size

    1.3MB

  • Sample

    250107-ejc5ravpcl

  • MD5

    4c31ea31113e35d75360f31d5677527f

  • SHA1

    117ec44890f540618a6a2aa3a8018a9231091b84

  • SHA256

    18374c67d37448e2a979d254c295f81173a493b4e0fd5eb3c80a3f6858271d12

  • SHA512

    dd38cd897677f2290724227b045cd384643d952b55c790708e718c1fed1ecee897b1f8a4cbf6309c2eaecd9e059157795a2028715514df5e6e8962378e800e21

  • SSDEEP

    24576:DNR2zaQBt37/CZ0w1PeWnzqhqCC6+PEI+J36U+r3fUA6wKkS:iUsrC6aEfJmLzKL

Score
10/10
isrstealercollectiondiscoverypersistencespywarestealertrojanupx

Malware Config

Targets

    • Target

      JaffaCakes118_4c31ea31113e35d75360f31d5677527f

    • Size

      1.3MB

    • MD5

      4c31ea31113e35d75360f31d5677527f

    • SHA1

      117ec44890f540618a6a2aa3a8018a9231091b84

    • SHA256

      18374c67d37448e2a979d254c295f81173a493b4e0fd5eb3c80a3f6858271d12

    • SHA512

      dd38cd897677f2290724227b045cd384643d952b55c790708e718c1fed1ecee897b1f8a4cbf6309c2eaecd9e059157795a2028715514df5e6e8962378e800e21

    • SSDEEP

      24576:DNR2zaQBt37/CZ0w1PeWnzqhqCC6+PEI+J36U+r3fUA6wKkS:iUsrC6aEfJmLzKL

    Score
    10/10
    isrstealercollectiondiscoverypersistencespywarestealertrojanupx

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Isrstealer family

      isrstealer

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks