General

  • Target

    f7ef5eaf4e9279f6b6ca74672bbd96c3b52e45259dbaa402c40dc536dcba7081

  • Size

    506KB

  • Sample

    221106-naszaabcgp

  • MD5

    3e3a9dca80a8151f9e7f3e54dc6b2b24

  • SHA1

    1f8d00bedd6b81d57f1d483ad445d36769142c45

  • SHA256

    f7ef5eaf4e9279f6b6ca74672bbd96c3b52e45259dbaa402c40dc536dcba7081

  • SHA512

    27d64a9cf90a7b8d56e1608c4bc3ca71572d90b8aca676a69536f9bef0462da7680a92c738f8efd602d81d51af3bb9ebc17dfa51615137a1a394c2fe312d8611

  • SSDEEP

    12288:VJG8DwOR03F3o6pow4d5bSVlh1Cqda/e+SyFO:vG8DEmPbS11CqczO

Malware Config

Targets

    • Target

      f7ef5eaf4e9279f6b6ca74672bbd96c3b52e45259dbaa402c40dc536dcba7081

    • Size

      506KB

    • MD5

      3e3a9dca80a8151f9e7f3e54dc6b2b24

    • SHA1

      1f8d00bedd6b81d57f1d483ad445d36769142c45

    • SHA256

      f7ef5eaf4e9279f6b6ca74672bbd96c3b52e45259dbaa402c40dc536dcba7081

    • SHA512

      27d64a9cf90a7b8d56e1608c4bc3ca71572d90b8aca676a69536f9bef0462da7680a92c738f8efd602d81d51af3bb9ebc17dfa51615137a1a394c2fe312d8611

    • SSDEEP

      12288:VJG8DwOR03F3o6pow4d5bSVlh1Cqda/e+SyFO:vG8DEmPbS11CqczO

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

    • ISR Stealer payload

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks