General

  • Target

    0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36

  • Size

    302KB

  • Sample

    221021-khvajabfcq

  • MD5

    550b2de6efda3c987d936991de5aef80

  • SHA1

    864920c84afefda5b9244a2b6dbc830ab6937dc1

  • SHA256

    0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36

  • SHA512

    a38fbd62e91bd88996bf301b5f6125e675b781b6d53b6da701592aeeac1413aea0fbdbebefc156c72e0160c3c0cc60c8982ebd99ed116f05b9c3946580386774

  • SSDEEP

    6144:ticZCJTbwkBUbkh1Jeld/tajvoY6scY3o8vY3R2ZtfM:Ep2MUYh1AV7YPE8vrZtfM

Malware Config

Targets

    • Target

      0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36

    • Size

      302KB

    • MD5

      550b2de6efda3c987d936991de5aef80

    • SHA1

      864920c84afefda5b9244a2b6dbc830ab6937dc1

    • SHA256

      0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36

    • SHA512

      a38fbd62e91bd88996bf301b5f6125e675b781b6d53b6da701592aeeac1413aea0fbdbebefc156c72e0160c3c0cc60c8982ebd99ed116f05b9c3946580386774

    • SSDEEP

      6144:ticZCJTbwkBUbkh1Jeld/tajvoY6scY3o8vY3R2ZtfM:Ep2MUYh1AV7YPE8vrZtfM

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

    • ISR Stealer payload

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • Nirsoft

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks