Overview

overview

10

Static

static

bb9e8fb1a9...0b.exe

windows7-x64

10

bb9e8fb1a9...0b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

  • Size

    352KB

  • Sample

    221121-3glk4sbe39

  • MD5

    c8c6cdeaea4f3940144b5e2fb282f234

  • SHA1

    37afce95c7db06c3d13c80a826bcf53be566f030

  • SHA256

    bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

  • SHA512

    54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

  • SSDEEP

    6144:gAsItRdQwMQvw0TLtSv1zzM69R27oQ+O15i+S+BsA9vOD/3xHRJ:gNI/+wNltSb9R28QH15J/m73xxJ

Score
10/10
isrstealerpersistencestealertrojan

Malware Config

Targets

    • Target

      bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

    • Size

      352KB

    • MD5

      c8c6cdeaea4f3940144b5e2fb282f234

    • SHA1

      37afce95c7db06c3d13c80a826bcf53be566f030

    • SHA256

      bb9e8fb1a954a00fffa3c29dca8807d09e6c31a44d597e3d278ad98d0ed4b80b

    • SHA512

      54dd1f2bf8d5db6b14ab6daa19125515ff663623300c5a8c815538c761249a190f4c14b589b227d21313516c263f949a525771ebfe6fd1268ab643ce718cf7a5

    • SSDEEP

      6144:gAsItRdQwMQvw0TLtSv1zzM69R27oQ+O15i+S+BsA9vOD/3xHRJ:gNI/+wNltSb9R28QH15J/m73xxJ

    Score
    10/10
    isrstealerpersistencestealertrojan

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks