isrstealer | 2c34e7bd53c5880be9898396ead603f70536254c468584b500d8a2e8acf44393

General

Target

2c34e7bd53c5880be9898396ead603f70536254c468584b500d8a2e8acf44393
Size

882KB
Sample

221030-jmp1yahhf8
MD5

b6de2482b98fce903d3692d9c0160ef2
SHA1

53d6ffc6c70417c12c67108e68a068d01dc31065
SHA256

2c34e7bd53c5880be9898396ead603f70536254c468584b500d8a2e8acf44393
SHA512

03fbba2e5e174f105ef70e53824c2a18fc82c49ce7469929a6904be3b98fd151e1c9587a429bb5ba42e4abd50515bdaf7aeb1c495db79e50f8e42328770e44bc
SSDEEP

12288:itdhEsXr70C7yHybdfMoclgKYEu9dbJE8arAVycIjtx9RwJ01WPbU7NI51u/33E0:+dh1797tR2gKU68alckZQ9z1Cwolt5

Score

10^/10

Malware Config

Targets

- Target
  
  2c34e7bd53c5880be9898396ead603f70536254c468584b500d8a2e8acf44393
- Size
  
  882KB
- MD5
  
  b6de2482b98fce903d3692d9c0160ef2
- SHA1
  
  53d6ffc6c70417c12c67108e68a068d01dc31065
- SHA256
  
  2c34e7bd53c5880be9898396ead603f70536254c468584b500d8a2e8acf44393
- SHA512
  
  03fbba2e5e174f105ef70e53824c2a18fc82c49ce7469929a6904be3b98fd151e1c9587a429bb5ba42e4abd50515bdaf7aeb1c495db79e50f8e42328770e44bc
- SSDEEP
  
  12288:itdhEsXr70C7yHybdfMoclgKYEu9dbJE8arAVycIjtx9RwJ01WPbU7NI51u/33E0:+dh1797tR2gKU68alckZQ9z1Cwolt5
Score

10^/10

isrstealer collection stealer trojan upx
- ISR Stealer
  ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
  trojan stealer isrstealer
- ISR Stealer payload
- NirSoft MailPassView
  Password recovery tool for various email clients
- Nirsoft
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

ISR Stealer

ISR Stealer payload

NirSoft MailPassView

Nirsoft

Executes dropped EXE

UPX packed file

Checks computer location settings

Loads dropped DLL

Accesses Microsoft Outlook accounts

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2