Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
JaffaCakes118_785e50fbd71019805a7979d83a98972a
-
Size
481KB
-
Sample
250316-bz9l4s1rv5
-
MD5
785e50fbd71019805a7979d83a98972a
-
SHA1
1527ca576e292205bc084e99c439b4b42607dc1e
-
SHA256
9ffdc9c7ec35f2e747c109071c0ec23995a7261674d3f6915fec1e3af904a12f
-
SHA512
90715fd7bcfdaaefd84d5470c18a7cc169eee550dbba0c5fe065267313ae7c06c2a68053b16522022b95420099a3345076522ae9137991fee94fdfa403e0d286
-
SSDEEP
12288:68aXcGD59oXrDvD4d6NUJcoNLeTPmo4ydpb:iXcI59Gr7D44eYTpb
Malware Config
Targets
-
-
Target
JaffaCakes118_785e50fbd71019805a7979d83a98972a
-
Size
481KB
-
MD5
785e50fbd71019805a7979d83a98972a
-
SHA1
1527ca576e292205bc084e99c439b4b42607dc1e
-
SHA256
9ffdc9c7ec35f2e747c109071c0ec23995a7261674d3f6915fec1e3af904a12f
-
SHA512
90715fd7bcfdaaefd84d5470c18a7cc169eee550dbba0c5fe065267313ae7c06c2a68053b16522022b95420099a3345076522ae9137991fee94fdfa403e0d286
-
SSDEEP
12288:68aXcGD59oXrDvD4d6NUJcoNLeTPmo4ydpb:iXcI59Gr7D44eYTpb
Score10/10-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload
-
Isrstealer family
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts
-
Suspicious use of SetThreadContext
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-