isrstealer | 5b72ca62dd81f1419b3b7598c96160c19d124fe6ec657d0d35f55795a467e35b

General

Target

5b72ca62dd81f1419b3b7598c96160c19d124fe6ec657d0d35f55795a467e35b
Size

1.2MB
Sample

221123-rjsawsbg5z
MD5

fe5175560342c0936f33072bc5f125c2
SHA1

12f3bb5a0822e8317cf0444a215322f5bed9e6dd
SHA256

5b72ca62dd81f1419b3b7598c96160c19d124fe6ec657d0d35f55795a467e35b
SHA512

8ae02d9e6e44db218f99e84b6b945d228646ea4bb5e1dae5621d03f1a09a043e729723dbb1ee463a4ce15507d1cd21f30f64ebd1a09ef4266fa770fd78c0960d
SSDEEP

24576:di4FmmfgFuk/3OtOZHcgxW7NbQkGt4ST69cv20euBXaXlSJitbxSrYFnDzh/hvEe:di4FmmfgUk/etOZHcgY7NbQkGqST69w+

Score

10^/10

Malware Config

Targets

- Target
  
  5b72ca62dd81f1419b3b7598c96160c19d124fe6ec657d0d35f55795a467e35b
- Size
  
  1.2MB
- MD5
  
  fe5175560342c0936f33072bc5f125c2
- SHA1
  
  12f3bb5a0822e8317cf0444a215322f5bed9e6dd
- SHA256
  
  5b72ca62dd81f1419b3b7598c96160c19d124fe6ec657d0d35f55795a467e35b
- SHA512
  
  8ae02d9e6e44db218f99e84b6b945d228646ea4bb5e1dae5621d03f1a09a043e729723dbb1ee463a4ce15507d1cd21f30f64ebd1a09ef4266fa770fd78c0960d
- SSDEEP
  
  24576:di4FmmfgFuk/3OtOZHcgxW7NbQkGt4ST69cv20euBXaXlSJitbxSrYFnDzh/hvEe:di4FmmfgUk/etOZHcgY7NbQkGqST69w+
Score

10^/10

isrstealer collection spyware stealer trojan upx
- ISR Stealer
  ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
  trojan stealer isrstealer
- ISR Stealer payload
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2