General

  • Target

    161d4de39ca95ff50682c36624d03beca497957619f7b69b5ecae8b045cf22f6

  • Size

    404KB

  • Sample

    221123-r9wq1adg5s

  • MD5

    4e41e8f87c89c2f7dd423a0750871b81

  • SHA1

    fc85caa8b48841fbd8064fc7bbe3a1d13b2c8992

  • SHA256

    161d4de39ca95ff50682c36624d03beca497957619f7b69b5ecae8b045cf22f6

  • SHA512

    1eaf21197de113e55c2bdf2db6522245a2381d0696f9caa4f6c26e9443cdfe38f78c4d8a04e0b0baae58c1ee7a406fdf1336bfad4a921e1d6da2c09913f790ed

  • SSDEEP

    12288:/B/USBseMoZWv6TuKHM+mm7Q2aQfRE6QMm:/BUJepkyTrHM+mEjaQftQ3

Malware Config

Targets

    • Target

      161d4de39ca95ff50682c36624d03beca497957619f7b69b5ecae8b045cf22f6

    • Size

      404KB

    • MD5

      4e41e8f87c89c2f7dd423a0750871b81

    • SHA1

      fc85caa8b48841fbd8064fc7bbe3a1d13b2c8992

    • SHA256

      161d4de39ca95ff50682c36624d03beca497957619f7b69b5ecae8b045cf22f6

    • SHA512

      1eaf21197de113e55c2bdf2db6522245a2381d0696f9caa4f6c26e9443cdfe38f78c4d8a04e0b0baae58c1ee7a406fdf1336bfad4a921e1d6da2c09913f790ed

    • SSDEEP

      12288:/B/USBseMoZWv6TuKHM+mm7Q2aQfRE6QMm:/BUJepkyTrHM+mEjaQftQ3

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

    • ISR Stealer payload

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • Nirsoft

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks