Overview

overview

10

Static

static

e3fd3e05a7...e0.exe

windows7-x64

10

e3fd3e05a7...e0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e3fd3e05a7bd5a85af2e0ee264d73eb76af885b3d2b054f6d4caa8e3e91118e0

  • Size

    670KB

  • Sample

    221127-2w5f4aef64

  • MD5

    5aa5d008136ee1d8ff62ed43d542347e

  • SHA1

    bed4c146c4ad8000ce9b7d3ebac027cf98190384

  • SHA256

    e3fd3e05a7bd5a85af2e0ee264d73eb76af885b3d2b054f6d4caa8e3e91118e0

  • SHA512

    f2e45c7d27bb72afc0dde33b6837c0ed842342e93e3894db0d665c97676346f5cd2c7e277bbe14b6279635cfca49de550ee6a43dfb5abcde7f2cacd8fcde727b

  • SSDEEP

    12288:DU5AxENsBnveIebg0zOOeE32U/0XjjWY0nPVSr1xAFbao:g5cvEbNyOeETEjKYEPVSZK5

Score
10/10
isrstealercollectionpersistencespywarestealertrojanupx

Malware Config

Targets

    • Target

      e3fd3e05a7bd5a85af2e0ee264d73eb76af885b3d2b054f6d4caa8e3e91118e0

    • Size

      670KB

    • MD5

      5aa5d008136ee1d8ff62ed43d542347e

    • SHA1

      bed4c146c4ad8000ce9b7d3ebac027cf98190384

    • SHA256

      e3fd3e05a7bd5a85af2e0ee264d73eb76af885b3d2b054f6d4caa8e3e91118e0

    • SHA512

      f2e45c7d27bb72afc0dde33b6837c0ed842342e93e3894db0d665c97676346f5cd2c7e277bbe14b6279635cfca49de550ee6a43dfb5abcde7f2cacd8fcde727b

    • SSDEEP

      12288:DU5AxENsBnveIebg0zOOeE32U/0XjjWY0nPVSr1xAFbao:g5cvEbNyOeETEjKYEPVSZK5

    Score
    10/10
    isrstealercollectionpersistencespywarestealertrojanupx

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Modifies WinLogon for persistence

      persistence

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • Nirsoft

    • Drops file in Drivers directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks