Extracted

• • Target

    1278d28900aa2365dee77d6e421c76175c653b624e48521ace51c7b6af3c4173

  • Size

    653KB

  • MD5

    88049ef487b421c89a7c57f7cd030747

  • SHA1

    31e8a574df10db1650a47fb7f95f69dfa89ec72a

  • SHA256

    1278d28900aa2365dee77d6e421c76175c653b624e48521ace51c7b6af3c4173

  • SHA512

    45938d26e9b5778aee4b2e53d44daed85137ebacd536d333bc4c01e7651497ece758b2123df6db9998073ce59c55955ffe72acfb0f75aedb2b0f4b72c5ef5f87

  • SSDEEP

    12288:V9qry/CuKAUokVqrT+jjJK2B8qCYm4xrlVHs82:+rKeVUT+jjJb8qCGZVHo

  Score

  10^/10

  isrstealersalitybackdoorcollectionevasionstealertrojanupx

  • ISR Stealer

    ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

    trojanstealerisrstealer

  • ISR Stealer payload

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • Nirsoft

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses Microsoft Outlook accounts

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2