isrstealer | ea00bfb017bd00a331d033863bc4f81c626ba96668beaea703172aa4edefa618 | Triage

Submit
Reports

Overview

overview

Static

static

ea00bfb017...18.exe

windows7-x64

ea00bfb017...18.exe

windows10-2004-x64

Sharing

General

Target

ea00bfb017bd00a331d033863bc4f81c626ba96668beaea703172aa4edefa618
Size

350KB
Sample

221002-n3n6ssfdcp
MD5

6cd01c6c456e2831ecdafb575d783c4d
SHA1

4164244dcda6811f4ad239ab139f00b11381a031
SHA256

ea00bfb017bd00a331d033863bc4f81c626ba96668beaea703172aa4edefa618
SHA512

4c9e50090121f60d1fd4e19c2910a0d3c6c59364b642345e76f53fd2250316e1c6fedc3898715c97123e02c46f64689556665c775385c2cdc10f9ab6c0a82039
SSDEEP

6144:jwUSAb47OeNfJxOUwGjDkTk5y0H/1xqjlkKQb1UYcDtZsbR7f1PiIfPd:jpbx2zjDkAYM/1olkZKYchCbN8Wd

Score

10^/10

isrstealer collection persistence stealer trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

ea00bfb017bd00a331d033863bc4f81c626ba96668beaea703172aa4edefa618.exe

Resource

win7-20220812-en

isrstealer collection persistence stealer trojan upx

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

ea00bfb017bd00a331d033863bc4f81c626ba96668beaea703172aa4edefa618.exe

Resource

win10v2004-20220901-en

isrstealer collection persistence stealer trojan upx

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  ea00bfb017bd00a331d033863bc4f81c626ba96668beaea703172aa4edefa618
- Size
  
  350KB
- MD5
  
  6cd01c6c456e2831ecdafb575d783c4d
- SHA1
  
  4164244dcda6811f4ad239ab139f00b11381a031
- SHA256
  
  ea00bfb017bd00a331d033863bc4f81c626ba96668beaea703172aa4edefa618
- SHA512
  
  4c9e50090121f60d1fd4e19c2910a0d3c6c59364b642345e76f53fd2250316e1c6fedc3898715c97123e02c46f64689556665c775385c2cdc10f9ab6c0a82039
- SSDEEP
  
  6144:jwUSAb47OeNfJxOUwGjDkTk5y0H/1xqjlkKQb1UYcDtZsbR7f1PiIfPd:jpbx2zjDkAYM/1olkZKYchCbN8Wd
Score

10^/10

isrstealer collection persistence stealer trojan upx
- ISR Stealer
  ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
  trojan stealer isrstealer
- ISR Stealer payload
- NirSoft MailPassView
  Password recovery tool for various email clients
- Nirsoft
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

isrstealercollectionpersistencestealertrojanupx

behavioral2

isrstealercollectionpersistencestealertrojanupx

© 2018-2025

Terms | Privacy