isrstealer | dc5225380dea039e3ce7b5156361fc68bc205cfdba8c9976f77192f4979f14d9

General

Target

dc5225380dea039e3ce7b5156361fc68bc205cfdba8c9976f77192f4979f14d9
Size

368KB
Sample

221011-yspppaccgp
MD5

7b3ff7f2f522779c5bd0cc9862190210
SHA1

efbbee045ba78058f6735a472343fe9748834be8
SHA256

dc5225380dea039e3ce7b5156361fc68bc205cfdba8c9976f77192f4979f14d9
SHA512

ca3acc3d41a819fb37fd7a37c27fb19250846f5174c4d132e8d4e9f30caaa84aa3405d8c65cafba08328b1c11c445d28136de5bca934aee10156304b43ecf9b6
SSDEEP

6144:bYXlu7PKTgM8jlcud0oTPP/eqTNYDWyys9YIusnowR/gVxoCiLXcisNC79FPQ2Hx:2rTgM8j6QxNpyVY6/gV8F

Score

10^/10

Malware Config

Targets

- Target
  
  dc5225380dea039e3ce7b5156361fc68bc205cfdba8c9976f77192f4979f14d9
- Size
  
  368KB
- MD5
  
  7b3ff7f2f522779c5bd0cc9862190210
- SHA1
  
  efbbee045ba78058f6735a472343fe9748834be8
- SHA256
  
  dc5225380dea039e3ce7b5156361fc68bc205cfdba8c9976f77192f4979f14d9
- SHA512
  
  ca3acc3d41a819fb37fd7a37c27fb19250846f5174c4d132e8d4e9f30caaa84aa3405d8c65cafba08328b1c11c445d28136de5bca934aee10156304b43ecf9b6
- SSDEEP
  
  6144:bYXlu7PKTgM8jlcud0oTPP/eqTNYDWyys9YIusnowR/gVxoCiLXcisNC79FPQ2Hx:2rTgM8j6QxNpyVY6/gV8F
Score

10^/10

isrstealer persistence spyware stealer trojan upx
- ISR Stealer
  ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
  trojan stealer isrstealer
- ISR Stealer payload
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2