isrstealer | ba4dc000d960320fa8d9668d26f4cd5c78bbd8e44ae04ae817584e456c92a251

General

Target

ba4dc000d960320fa8d9668d26f4cd5c78bbd8e44ae04ae817584e456c92a251
Size

591KB
Sample

221123-qhnqmsha8x
MD5

c18562474f24706670e0885df66c05e3
SHA1

599c4cf063d1c7253fc7e96879356a5eeea75907
SHA256

ba4dc000d960320fa8d9668d26f4cd5c78bbd8e44ae04ae817584e456c92a251
SHA512

516c89b1082a3daef36f7c634699c18152fe612c99ff6360042917af220227edbaeafa2fd797e6de107c7e392000672fae2f711d6cc9cd35822d12bb1c4cdb50
SSDEEP

12288:Cv+dNIpYv6qGVegup6kNlhyKklCfyBMVA+7YJ+/UvC7YeTVth:5mO6qIup6kBUzh7QscL

Score

10^/10

Malware Config

Targets

- Target
  
  ba4dc000d960320fa8d9668d26f4cd5c78bbd8e44ae04ae817584e456c92a251
- Size
  
  591KB
- MD5
  
  c18562474f24706670e0885df66c05e3
- SHA1
  
  599c4cf063d1c7253fc7e96879356a5eeea75907
- SHA256
  
  ba4dc000d960320fa8d9668d26f4cd5c78bbd8e44ae04ae817584e456c92a251
- SHA512
  
  516c89b1082a3daef36f7c634699c18152fe612c99ff6360042917af220227edbaeafa2fd797e6de107c7e392000672fae2f711d6cc9cd35822d12bb1c4cdb50
- SSDEEP
  
  12288:Cv+dNIpYv6qGVegup6kNlhyKklCfyBMVA+7YJ+/UvC7YeTVth:5mO6qIup6kBUzh7QscL
Score

10^/10

isrstealer persistence spyware stealer trojan upx
- ISR Stealer
  ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
  trojan stealer isrstealer
- ISR Stealer payload
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

ISR Stealer

ISR Stealer payload

Executes dropped EXE

UPX packed file

Loads dropped DLL

Reads user/profile data of web browsers

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2