Extracted

• • Target

    5927e4d65f85b8656396c8f02379f3954d38f19ac63e9d00596f666f6dc796ab

  • Size

    989KB

  • MD5

    09f7912493d7b995e0d765387b8ce2a1

  • SHA1

    0bcf195f1a77e3d02c67b532780796fb1a37d25f

  • SHA256

    5927e4d65f85b8656396c8f02379f3954d38f19ac63e9d00596f666f6dc796ab

  • SHA512

    97cd60f9afca58ccd0b52d54ac9b0f4ea8f7c2d03a500ee16df7e1d3ce1a1c4fca13ee5e919e4787c44729a4bff45a28f9831e07259649064e77de889be1dba1

  Score

  10^/10

  isrstealernetwirebotnetcollectionpersistenceratspywarestealertrojanupx

  • ISR Stealer

    ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

    trojanstealerisrstealer

  • ISR Stealer payload

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • Nirsoft

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2