General

  • Target

    b3de5859d79cba761fb3f22ffb4f2c674452d4ddedc2732b9a1bc0fbed0926b9

  • Size

    360KB

  • Sample

    221121-3gjfrabe36

  • MD5

    5d0c3fed471d11d19e9dc10103bead3e

  • SHA1

    865d8950c66519d206261926538e40073a252954

  • SHA256

    b3de5859d79cba761fb3f22ffb4f2c674452d4ddedc2732b9a1bc0fbed0926b9

  • SHA512

    76285d896b45586660456b646910a822203325d57789abfb4619974620f18c370cdd9988331f8fe1283d0c16431d1c46aeae7e9fe2e55537d1ef7a041bac8f50

  • SSDEEP

    6144:8xM8Skop7Dv+mmaX75j/12D3URRUAwDirJWjnc9gxuDFBHGFgiw:4cpHv+baX7n2QzUBDRjnc9ScFZG0

Malware Config

Targets

    • Target

      b3de5859d79cba761fb3f22ffb4f2c674452d4ddedc2732b9a1bc0fbed0926b9

    • Size

      360KB

    • MD5

      5d0c3fed471d11d19e9dc10103bead3e

    • SHA1

      865d8950c66519d206261926538e40073a252954

    • SHA256

      b3de5859d79cba761fb3f22ffb4f2c674452d4ddedc2732b9a1bc0fbed0926b9

    • SHA512

      76285d896b45586660456b646910a822203325d57789abfb4619974620f18c370cdd9988331f8fe1283d0c16431d1c46aeae7e9fe2e55537d1ef7a041bac8f50

    • SSDEEP

      6144:8xM8Skop7Dv+mmaX75j/12D3URRUAwDirJWjnc9gxuDFBHGFgiw:4cpHv+baX7n2QzUBDRjnc9ScFZG0

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

    • ISR Stealer payload

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • Nirsoft

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook accounts

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks