Overview

overview

10

Static

static

ad1a4c5946...8c.exe

windows7_x64

10

ad1a4c5946...8c.exe

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ad1a4c5946a69d9cae50f2dd06676f8b93291a794b21bf8fdb807e44575ca08c

  • Size

    340KB

  • Sample

    220308-mefzvagdcm

  • MD5

    8a4e7a24fc1e0828ed209a7adcd023ea

  • SHA1

    a6d749c5a2d019821c7635827ae3a96d29e729d2

  • SHA256

    ad1a4c5946a69d9cae50f2dd06676f8b93291a794b21bf8fdb807e44575ca08c

  • SHA512

    defe84bb5119e386534b8c894974d4dd68e8fc6b360b7bccad5cb13bb093a91801317363c86017ab7a48bcb4d9d89298d8b7ee105ff10f6bef38418ad31065d9

Score
10/10
isrstealercollectionpersistencespywarestealersuricatatrojanupx

Malware Config

Targets

    • Target

      ad1a4c5946a69d9cae50f2dd06676f8b93291a794b21bf8fdb807e44575ca08c

    • Size

      340KB

    • MD5

      8a4e7a24fc1e0828ed209a7adcd023ea

    • SHA1

      a6d749c5a2d019821c7635827ae3a96d29e729d2

    • SHA256

      ad1a4c5946a69d9cae50f2dd06676f8b93291a794b21bf8fdb807e44575ca08c

    • SHA512

      defe84bb5119e386534b8c894974d4dd68e8fc6b360b7bccad5cb13bb093a91801317363c86017ab7a48bcb4d9d89298d8b7ee105ff10f6bef38418ad31065d9

    Score
    10/10
    isrstealercollectionpersistencespywarestealersuricatatrojanupx

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer Payload

    • suricata: ET MALWARE ISRStealer Checkin

      suricata: ET MALWARE ISRStealer Checkin

      suricata

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • Nirsoft

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks