isrstealer | a371c45b9e43f518eb3f66b1f1134064ca28c618a03aca63ab621888e12a1d08 | Triage

Submit
Reports

Overview

overview

Static

static

3

JaffaCakes...c2.exe

windows7-x64

JaffaCakes...c2.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_c9a28e7a089a43ff800fd32a94e8edc2
Size

223KB
Sample

250209-bwrbcsslel
MD5

c9a28e7a089a43ff800fd32a94e8edc2
SHA1

77a610930174021c7000c06f14e4b1a7bcc275c8
SHA256

a371c45b9e43f518eb3f66b1f1134064ca28c618a03aca63ab621888e12a1d08
SHA512

89d94e4524cd1540e55822ebcbad2a4068f7562060885b4c8cb93b0610be9d61d2d90b3d9ed46dc76780d9cba1c97cb5ded2a7ca2ef77447a859783711fd26bd
SSDEEP

3072:doy9wREmk+EIoHWKTHpklRdHek0FU4+gbcNhHpDsANcniSx7CAEOY43CGgqx8sB9:doyME+EIkHmwFU7RpDsAeIn1G44Q8Rl

Score

10^/10

isrstealer discovery spyware stealer trojan upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_c9a28e7a089a43ff800fd32a94e8edc2.exe

Resource

win7-20240903-en

isrstealer discovery spyware stealer trojan upx

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_c9a28e7a089a43ff800fd32a94e8edc2.exe

Resource

win10v2004-20250207-en

isrstealer discovery spyware stealer trojan upx

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_c9a28e7a089a43ff800fd32a94e8edc2
- Size
  
  223KB
- MD5
  
  c9a28e7a089a43ff800fd32a94e8edc2
- SHA1
  
  77a610930174021c7000c06f14e4b1a7bcc275c8
- SHA256
  
  a371c45b9e43f518eb3f66b1f1134064ca28c618a03aca63ab621888e12a1d08
- SHA512
  
  89d94e4524cd1540e55822ebcbad2a4068f7562060885b4c8cb93b0610be9d61d2d90b3d9ed46dc76780d9cba1c97cb5ded2a7ca2ef77447a859783711fd26bd
- SSDEEP
  
  3072:doy9wREmk+EIoHWKTHpklRdHek0FU4+gbcNhHpDsANcniSx7CAEOY43CGgqx8sB9:doyME+EIkHmwFU7RpDsAeIn1G44Q8Rl
Score

10^/10

isrstealer discovery spyware stealer trojan upx
- ISR Stealer
  ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
  trojan stealer isrstealer
- ISR Stealer payload
- Isrstealer family
  isrstealer
- Downloads MZ/PE file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

isrstealerdiscoveryspywarestealertrojanupx

behavioral2

isrstealerdiscoveryspywarestealertrojanupx

© 2018-2025

Terms | Privacy