Overview

overview

10

Static

static

ee61c3cd76...46.exe

windows7-x64

10

ee61c3cd76...46.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ee61c3cd765c8722eb387c721240c3f9cac19815c6ca85232cf61cb21be0c146

  • Size

    411KB

  • Sample

    221107-tv3l4shghj

  • MD5

    a01fcb8ff07962da0a741648e74b3d3e

  • SHA1

    8d23ebbf844d6d4ab14d958d713d52bdf09811fe

  • SHA256

    ee61c3cd765c8722eb387c721240c3f9cac19815c6ca85232cf61cb21be0c146

  • SHA512

    f36e3293fb5217a88ecef4f5331dac4f11599b92503445eddaeb1675db659675b0806943d0f7dff9f27199c77e2885a0bc43f09427cf7f37e41d4fd172669aad

  • SSDEEP

    12288:/HE1sGf1s0tti1wIv2cPZXbV6INDd23+g:/um0tti+dUZNR23+

Score
10/10
isrstealercollectionpersistencespywarestealertrojanupx

Malware Config

Targets

    • Target

      ee61c3cd765c8722eb387c721240c3f9cac19815c6ca85232cf61cb21be0c146

    • Size

      411KB

    • MD5

      a01fcb8ff07962da0a741648e74b3d3e

    • SHA1

      8d23ebbf844d6d4ab14d958d713d52bdf09811fe

    • SHA256

      ee61c3cd765c8722eb387c721240c3f9cac19815c6ca85232cf61cb21be0c146

    • SHA512

      f36e3293fb5217a88ecef4f5331dac4f11599b92503445eddaeb1675db659675b0806943d0f7dff9f27199c77e2885a0bc43f09427cf7f37e41d4fd172669aad

    • SSDEEP

      12288:/HE1sGf1s0tti1wIv2cPZXbV6INDd23+g:/um0tti+dUZNR23+

    Score
    10/10
    isrstealercollectionpersistencespywarestealertrojanupx

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • Nirsoft

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks