General

  • Target

    9d6ad4d064375b8f55553a623fdd514933ae72786a2f5c371d521f10ca9bff38

  • Size

    332KB

  • Sample

    221119-vl9jqsbg94

  • MD5

    5dcd56fb5f489f9dba26539b88b4ad7b

  • SHA1

    4129413594687786d96e04f6eb88c9202907820b

  • SHA256

    9d6ad4d064375b8f55553a623fdd514933ae72786a2f5c371d521f10ca9bff38

  • SHA512

    1964bb9d7aa766d9a66732fefb6ce2302a4769a5a3ec5990579fa7e1fe067d0904a06031b009ef5ca0675922ddbf79ce52b550005853c37958038a05f69ee6f9

  • SSDEEP

    6144:fTfSHDu/vDH7AhaFJzdGgJGCB9ij+L8g0N2UCZSXIsz1bXj:LVXDH8ELNij4F04QXIsz1z

Malware Config

Targets

    • Target

      9d6ad4d064375b8f55553a623fdd514933ae72786a2f5c371d521f10ca9bff38

    • Size

      332KB

    • MD5

      5dcd56fb5f489f9dba26539b88b4ad7b

    • SHA1

      4129413594687786d96e04f6eb88c9202907820b

    • SHA256

      9d6ad4d064375b8f55553a623fdd514933ae72786a2f5c371d521f10ca9bff38

    • SHA512

      1964bb9d7aa766d9a66732fefb6ce2302a4769a5a3ec5990579fa7e1fe067d0904a06031b009ef5ca0675922ddbf79ce52b550005853c37958038a05f69ee6f9

    • SSDEEP

      6144:fTfSHDu/vDH7AhaFJzdGgJGCB9ij+L8g0N2UCZSXIsz1bXj:LVXDH8ELNij4F04QXIsz1z

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

    • ISR Stealer payload

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • Nirsoft

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks