Overview

overview

10

Static

static

d1abaee79c...c9.exe

windows7-x64

10

d1abaee79c...c9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d1abaee79cc284c622228a53081315d07bd81cfc1f06b3b7ddde9810d13477c9

  • Size

    1.1MB

  • Sample

    221106-l24trahahq

  • MD5

    104e3f305b7c3f64f888f5e62f865e40

  • SHA1

    fee24350df3533f82849c5ee867e091a43649986

  • SHA256

    d1abaee79cc284c622228a53081315d07bd81cfc1f06b3b7ddde9810d13477c9

  • SHA512

    0eb7929fae7c91dfcdabd970ae98a2df2b6164b928706e8b325d9d98ea8b65d5d8326fd0d59b2d923b567d628c7ccf9be442cac6942e8a10e8296122551d4fe0

  • SSDEEP

    24576:kt249Bnd2zADVkNSoc1xuzoVF5r5QAwFv0LbU:ezYMDVkNAfuw7B2Aw

Score
10/10
isrstealercollectionevasionpersistencestealertrojanupx

Malware Config

Targets

    • Target

      d1abaee79cc284c622228a53081315d07bd81cfc1f06b3b7ddde9810d13477c9

    • Size

      1.1MB

    • MD5

      104e3f305b7c3f64f888f5e62f865e40

    • SHA1

      fee24350df3533f82849c5ee867e091a43649986

    • SHA256

      d1abaee79cc284c622228a53081315d07bd81cfc1f06b3b7ddde9810d13477c9

    • SHA512

      0eb7929fae7c91dfcdabd970ae98a2df2b6164b928706e8b325d9d98ea8b65d5d8326fd0d59b2d923b567d628c7ccf9be442cac6942e8a10e8296122551d4fe0

    • SSDEEP

      24576:kt249Bnd2zADVkNSoc1xuzoVF5r5QAwFv0LbU:ezYMDVkNAfuw7B2Aw

    Score
    10/10
    isrstealercollectionevasionpersistencestealertrojanupx

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • Nirsoft

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks