Overview

overview

10

Static

static

bf71870b86...7a.exe

windows7-x64

10

bf71870b86...7a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bf71870b86adb5d0aa6290073c4a21465cded4e612a08a6b9db30dd1a927fe7a

  • Size

    562KB

  • Sample

    221123-tgphbshb2x

  • MD5

    d871fa1f2eda016986362b5d3d55ad53

  • SHA1

    d66d8e4b3f77589668471835cfe251aa5b1bf544

  • SHA256

    bf71870b86adb5d0aa6290073c4a21465cded4e612a08a6b9db30dd1a927fe7a

  • SHA512

    eeee76a71022eca49046017689c7d02e5f62bfe6dcb75005797d2e8d1c891b812732c71e66564e6a47ed70d7a5ec9db95d55ddb3011a3725a03723aac5e4be33

  • SSDEEP

    12288:K7fi9Y9z8k0GdekXhMfugzCpx7WPqD1041uBs4ivdsjTq:K7eY9zYCeWhMfzOpxaPk04bB

Score
10/10
isrstealerspywarestealertrojanupx

Malware Config

Targets

    • Target

      bf71870b86adb5d0aa6290073c4a21465cded4e612a08a6b9db30dd1a927fe7a

    • Size

      562KB

    • MD5

      d871fa1f2eda016986362b5d3d55ad53

    • SHA1

      d66d8e4b3f77589668471835cfe251aa5b1bf544

    • SHA256

      bf71870b86adb5d0aa6290073c4a21465cded4e612a08a6b9db30dd1a927fe7a

    • SHA512

      eeee76a71022eca49046017689c7d02e5f62bfe6dcb75005797d2e8d1c891b812732c71e66564e6a47ed70d7a5ec9db95d55ddb3011a3725a03723aac5e4be33

    • SSDEEP

      12288:K7fi9Y9z8k0GdekXhMfugzCpx7WPqD1041uBs4ivdsjTq:K7eY9zYCeWhMfzOpxaPk04bB

    Score
    10/10
    isrstealerspywarestealertrojanupx

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks