General

  • Target

    0876731d852c663354e776410f30bb1574d6c7b8735b8a81dfa2f0270319e56d

  • Size

    443KB

  • Sample

    220530-1qspnsgddq

  • MD5

    a2b464f08c2e7bb43c902aa2a2f8fa19

  • SHA1

    0bd743fe4900777b51ce409a94575e82dca29560

  • SHA256

    0876731d852c663354e776410f30bb1574d6c7b8735b8a81dfa2f0270319e56d

  • SHA512

    7f88bd9823fd5ede00f7178992eec1f250e05c57b8816507b688ff17d3dc4a23f10016413e3237336332c305aaf7a8d3cfbccf4e5d4c1ebb1852504426aa3845

Malware Config

Targets

    • Target

      0876731d852c663354e776410f30bb1574d6c7b8735b8a81dfa2f0270319e56d

    • Size

      443KB

    • MD5

      a2b464f08c2e7bb43c902aa2a2f8fa19

    • SHA1

      0bd743fe4900777b51ce409a94575e82dca29560

    • SHA256

      0876731d852c663354e776410f30bb1574d6c7b8735b8a81dfa2f0270319e56d

    • SHA512

      7f88bd9823fd5ede00f7178992eec1f250e05c57b8816507b688ff17d3dc4a23f10016413e3237336332c305aaf7a8d3cfbccf4e5d4c1ebb1852504426aa3845

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

    • ISR Stealer Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks