Overview

overview

10

Static

static

3

JaffaCakes...79.exe

windows7-x64

10

JaffaCakes...79.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_6d2a7770d449ca77cdbaf19427f8df79

  • Size

    1.7MB

  • Sample

    250131-xwajhawqak

  • MD5

    6d2a7770d449ca77cdbaf19427f8df79

  • SHA1

    bf9c217cbc4577bc16d6e696974d22b17e8f3c64

  • SHA256

    50c3713014eefe6d7a2776d34cc38160f32b1154d0fde6539e506a6fcaf66196

  • SHA512

    21c8877a24344ee8f3b7ab4d4e3fe0ffdc7aa28b8b28e3bf91742918b9e069d788363acf8ff3dfad742e8ce6505983db502a94579ffee3f3ca46f2dd9605653c

  • SSDEEP

    49152:v7PcpfOyQmi8yhCNhak8xZ/tJbE/97lGWW868Ie97V:vUfOyVi8yhvk8xZHbE/90WW82u5

Score
10/10
isrstealerdiscoverypersistencestealertrojanupx

Malware Config

Targets

    • Target

      JaffaCakes118_6d2a7770d449ca77cdbaf19427f8df79

    • Size

      1.7MB

    • MD5

      6d2a7770d449ca77cdbaf19427f8df79

    • SHA1

      bf9c217cbc4577bc16d6e696974d22b17e8f3c64

    • SHA256

      50c3713014eefe6d7a2776d34cc38160f32b1154d0fde6539e506a6fcaf66196

    • SHA512

      21c8877a24344ee8f3b7ab4d4e3fe0ffdc7aa28b8b28e3bf91742918b9e069d788363acf8ff3dfad742e8ce6505983db502a94579ffee3f3ca46f2dd9605653c

    • SSDEEP

      49152:v7PcpfOyQmi8yhCNhak8xZ/tJbE/97lGWW868Ie97V:vUfOyVi8yhvk8xZHbE/90WW82u5

    Score
    10/10
    isrstealerdiscoverypersistencestealertrojanupx

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Isrstealer family

      isrstealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks