Overview

overview

10

Static

static

f3008c11dc...2f.exe

windows7-x64

10

f3008c11dc...2f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f3008c11dc215c5db0b82c93a8cc5c8afd2ef154889573e88d879c68e6066e2f

  • Size

    323KB

  • Sample

    221011-swgwcsbfe8

  • MD5

    1b986a1f53dfc0bb762172b2d6d52e78

  • SHA1

    6fece4cd66ffe5fd6cc1a383ab85bc9b8627f327

  • SHA256

    f3008c11dc215c5db0b82c93a8cc5c8afd2ef154889573e88d879c68e6066e2f

  • SHA512

    2f8dc801f387de41e174b6320f08ba99a8333ff1642f95a4b44618fca619ba2bae1d37731618448256b1d2d67bed8e54fb028f44b4170697a376a9ef24f77cb8

  • SSDEEP

    6144:KQ1xPms0XvoZpZis42ynaL3zUxMuu5ihPoAqYLCm+x/54:K8A0JsaluukAT5R5

Score
10/10
isrstealercollectionpersistencespywarestealertrojanupx

Malware Config

Targets

    • Target

      f3008c11dc215c5db0b82c93a8cc5c8afd2ef154889573e88d879c68e6066e2f

    • Size

      323KB

    • MD5

      1b986a1f53dfc0bb762172b2d6d52e78

    • SHA1

      6fece4cd66ffe5fd6cc1a383ab85bc9b8627f327

    • SHA256

      f3008c11dc215c5db0b82c93a8cc5c8afd2ef154889573e88d879c68e6066e2f

    • SHA512

      2f8dc801f387de41e174b6320f08ba99a8333ff1642f95a4b44618fca619ba2bae1d37731618448256b1d2d67bed8e54fb028f44b4170697a376a9ef24f77cb8

    • SSDEEP

      6144:KQ1xPms0XvoZpZis42ynaL3zUxMuu5ihPoAqYLCm+x/54:K8A0JsaluukAT5R5

    Score
    10/10
    isrstealercollectionpersistencespywarestealertrojanupx

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • Nirsoft

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks