isrstealer | 2d207e7fd002f19b425a1df057dabd924b62a2066b944b3ded462e5c216f56af | Triage

Sharing

General

Target

JaffaCakes118_8fbfb5e43df6bf6bde62a55042d4b1cc
Size

76KB
Sample

250329-wkz5cavsdz
MD5

8fbfb5e43df6bf6bde62a55042d4b1cc
SHA1

913c49cf2b696e8bc615ca5d4d4a82db181f29f3
SHA256

2d207e7fd002f19b425a1df057dabd924b62a2066b944b3ded462e5c216f56af
SHA512

58106dee591e3a3c84f5941947e0488fa883a114118cb264e1947af965d8482bb66bc354367ac806543ce4d79da9ecbb35c56d2e94d59c54a07f40a4ed29177a
SSDEEP

1536:Tz3HBexMQT+2umeWO2+FPx/lXYVAG8Zs7kfl/ig8ON:sxMQeXYVQsel/iwN

Score

10^/10

isrstealer discovery spyware stealer

Malware Config

Targets

- Target
  
  JaffaCakes118_8fbfb5e43df6bf6bde62a55042d4b1cc
- Size
  
  76KB
- MD5
  
  8fbfb5e43df6bf6bde62a55042d4b1cc
- SHA1
  
  913c49cf2b696e8bc615ca5d4d4a82db181f29f3
- SHA256
  
  2d207e7fd002f19b425a1df057dabd924b62a2066b944b3ded462e5c216f56af
- SHA512
  
  58106dee591e3a3c84f5941947e0488fa883a114118cb264e1947af965d8482bb66bc354367ac806543ce4d79da9ecbb35c56d2e94d59c54a07f40a4ed29177a
- SSDEEP
  
  1536:Tz3HBexMQT+2umeWO2+FPx/lXYVAG8Zs7kfl/ig8ON:sxMQeXYVQsel/iwN
Score

7^/10

discovery spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer