Overview

overview

10

Static

static

3

JaffaCakes...2e.exe

windows7-x64

10

JaffaCakes...2e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_8bd0bf298b834a0b248f320b943bf92e

  • Size

    160KB

  • Sample

    250329-vmfytay1h1

  • MD5

    8bd0bf298b834a0b248f320b943bf92e

  • SHA1

    1d6c81b390fd87c214efaa4fb36eb609901649bc

  • SHA256

    ca9a0508098750e531fa463177c083ce1081272dd5d4171ca990452bde29b5b4

  • SHA512

    2ccf5702787849b3ba7e4cdea5d746113bf0746b7d826b102692533fb1c9c433d4ff2237aedab0dc646546476809632b9514bbe00f6bd0d970c41ffb263ec2f1

  • SSDEEP

    3072:1333CTQfE+ts5ivlINZni5StD/kJx9DYOy/WLLACxyvEL4ydXnX500NxY8Y8Zxm:13332P8s5AcZni5YknTy+LLACx0I4wXR

Score
10/10
isrstealerdiscoveryspywarestealertrojan

Malware Config

Targets

    • Target

      JaffaCakes118_8bd0bf298b834a0b248f320b943bf92e

    • Size

      160KB

    • MD5

      8bd0bf298b834a0b248f320b943bf92e

    • SHA1

      1d6c81b390fd87c214efaa4fb36eb609901649bc

    • SHA256

      ca9a0508098750e531fa463177c083ce1081272dd5d4171ca990452bde29b5b4

    • SHA512

      2ccf5702787849b3ba7e4cdea5d746113bf0746b7d826b102692533fb1c9c433d4ff2237aedab0dc646546476809632b9514bbe00f6bd0d970c41ffb263ec2f1

    • SSDEEP

      3072:1333CTQfE+ts5ivlINZni5StD/kJx9DYOy/WLLACxyvEL4ydXnX500NxY8Y8Zxm:13332P8s5AcZni5YknTy+LLACx0I4wXR

    Score
    10/10
    isrstealerdiscoveryspywarestealertrojan

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Isrstealer family

      isrstealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks