General

  • Target

    963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7

  • Size

    395KB

  • Sample

    221122-w1y7zscf99

  • MD5

    c95ed3586c26a3aa263dc5651fce813d

  • SHA1

    8e172e7204efcf6c5c04b8e2c9137b7871c762d3

  • SHA256

    963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7

  • SHA512

    0988bae3dedb12061fa76eeb2c40d8e5e136fc0be3fccb3cf7a4c0190c3ba9c7eb571ce532a04fafb5557131850c826aefb27fd33959172b675786c236c0fca5

  • SSDEEP

    12288:tFUrJodto5cK9HR/otQt/RKgZCHgOyUGp2AaPCwyz:bQ4WcK9WtQtbs0YApt

Malware Config

Targets

    • Target

      963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7

    • Size

      395KB

    • MD5

      c95ed3586c26a3aa263dc5651fce813d

    • SHA1

      8e172e7204efcf6c5c04b8e2c9137b7871c762d3

    • SHA256

      963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7

    • SHA512

      0988bae3dedb12061fa76eeb2c40d8e5e136fc0be3fccb3cf7a4c0190c3ba9c7eb571ce532a04fafb5557131850c826aefb27fd33959172b675786c236c0fca5

    • SSDEEP

      12288:tFUrJodto5cK9HR/otQt/RKgZCHgOyUGp2AaPCwyz:bQ4WcK9WtQtbs0YApt

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

    • ISR Stealer payload

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • Nirsoft

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks