isrstealer | 7e72a190a0a75742a2a3d4fda1bb9a39bf34fab823b1c4520d9d515542f2db1f

General

Target

7e72a190a0a75742a2a3d4fda1bb9a39bf34fab823b1c4520d9d515542f2db1f
Size

367KB
Sample

221030-pw2c8acaan
MD5

a2a7da9d4226d7aba9197f624efbc240
SHA1

28bf1add84abc9ffd59c82a89d9d8240e88856c5
SHA256

7e72a190a0a75742a2a3d4fda1bb9a39bf34fab823b1c4520d9d515542f2db1f
SHA512

c15a074ff963b86a904db22ab8147866474a30214e5f9304b7146b17e5acc3ab999ea89d785284d73a7ddf319856194579f7034a96170d801b1defcdcb515041
SSDEEP

6144:xjSwEQwBS4EQNlroQLyLsomG7wOxAyrN33ShVK0OHSTqar:xjFQBu1mowOxAyrFShVfwSV

Score

10^/10

Malware Config

Targets

- Target
  
  7e72a190a0a75742a2a3d4fda1bb9a39bf34fab823b1c4520d9d515542f2db1f
- Size
  
  367KB
- MD5
  
  a2a7da9d4226d7aba9197f624efbc240
- SHA1
  
  28bf1add84abc9ffd59c82a89d9d8240e88856c5
- SHA256
  
  7e72a190a0a75742a2a3d4fda1bb9a39bf34fab823b1c4520d9d515542f2db1f
- SHA512
  
  c15a074ff963b86a904db22ab8147866474a30214e5f9304b7146b17e5acc3ab999ea89d785284d73a7ddf319856194579f7034a96170d801b1defcdcb515041
- SSDEEP
  
  6144:xjSwEQwBS4EQNlroQLyLsomG7wOxAyrN33ShVK0OHSTqar:xjFQBu1mowOxAyrFShVfwSV
Score

10^/10

isrstealer collection stealer trojan upx
- ISR Stealer
  ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
  trojan stealer isrstealer
- ISR Stealer payload
- NirSoft MailPassView
  Password recovery tool for various email clients
- Nirsoft
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

ISR Stealer

ISR Stealer payload

NirSoft MailPassView

Nirsoft

Executes dropped EXE

UPX packed file

Checks computer location settings

Loads dropped DLL

Accesses Microsoft Outlook accounts

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2