General
-
Target
b3de5859d79cba761fb3f22ffb4f2c674452d4ddedc2732b9a1bc0fbed0926b9
-
Size
360KB
-
Sample
221121-3gjfrabe36
-
MD5
5d0c3fed471d11d19e9dc10103bead3e
-
SHA1
865d8950c66519d206261926538e40073a252954
-
SHA256
b3de5859d79cba761fb3f22ffb4f2c674452d4ddedc2732b9a1bc0fbed0926b9
-
SHA512
76285d896b45586660456b646910a822203325d57789abfb4619974620f18c370cdd9988331f8fe1283d0c16431d1c46aeae7e9fe2e55537d1ef7a041bac8f50
-
SSDEEP
6144:8xM8Skop7Dv+mmaX75j/12D3URRUAwDirJWjnc9gxuDFBHGFgiw:4cpHv+baX7n2QzUBDRjnc9ScFZG0
Static task
static1
Behavioral task
behavioral1
Sample
b3de5859d79cba761fb3f22ffb4f2c674452d4ddedc2732b9a1bc0fbed0926b9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b3de5859d79cba761fb3f22ffb4f2c674452d4ddedc2732b9a1bc0fbed0926b9.exe
Resource
win10v2004-20221111-en
Malware Config
Targets
-
-
Target
b3de5859d79cba761fb3f22ffb4f2c674452d4ddedc2732b9a1bc0fbed0926b9
-
Size
360KB
-
MD5
5d0c3fed471d11d19e9dc10103bead3e
-
SHA1
865d8950c66519d206261926538e40073a252954
-
SHA256
b3de5859d79cba761fb3f22ffb4f2c674452d4ddedc2732b9a1bc0fbed0926b9
-
SHA512
76285d896b45586660456b646910a822203325d57789abfb4619974620f18c370cdd9988331f8fe1283d0c16431d1c46aeae7e9fe2e55537d1ef7a041bac8f50
-
SSDEEP
6144:8xM8Skop7Dv+mmaX75j/12D3URRUAwDirJWjnc9gxuDFBHGFgiw:4cpHv+baX7n2QzUBDRjnc9ScFZG0
Score10/10-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload
-
NirSoft MailPassView
Password recovery tool for various email clients
-
Nirsoft
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-