General

  • Target

    0273f419416b2626a6047a1b848ca818e40f20be4be075237ebf02ea3ce381ab

  • Size

    799KB

  • Sample

    221127-wt6ngsgg55

  • MD5

    67cb4b511fa77b68a2113ff100c19d3b

  • SHA1

    149295633667f97ecaa61ad40d2643595175f262

  • SHA256

    0273f419416b2626a6047a1b848ca818e40f20be4be075237ebf02ea3ce381ab

  • SHA512

    d315d773a9800f3d69f22c18bf5aaf9935578a2283db695631389d8469fcfa7d6e94bdce894bd0f3f660721f6ae024203477b5567d188de7f25fc3680beb60a0

  • SSDEEP

    12288:yDwlmijm7u6o2t8ZrZ0ULh//VauajOtAIqXb75idAPcQcguD4FPQxPfOAzfiS/JN:WV4vDrFVaJqaIqrUAMB4FPQxJ/J0T

Malware Config

Targets

    • Target

      0273f419416b2626a6047a1b848ca818e40f20be4be075237ebf02ea3ce381ab

    • Size

      799KB

    • MD5

      67cb4b511fa77b68a2113ff100c19d3b

    • SHA1

      149295633667f97ecaa61ad40d2643595175f262

    • SHA256

      0273f419416b2626a6047a1b848ca818e40f20be4be075237ebf02ea3ce381ab

    • SHA512

      d315d773a9800f3d69f22c18bf5aaf9935578a2283db695631389d8469fcfa7d6e94bdce894bd0f3f660721f6ae024203477b5567d188de7f25fc3680beb60a0

    • SSDEEP

      12288:yDwlmijm7u6o2t8ZrZ0ULh//VauajOtAIqXb75idAPcQcguD4FPQxPfOAzfiS/JN:WV4vDrFVaJqaIqrUAMB4FPQxJ/J0T

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

    • ISR Stealer payload

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Uses the VBS compiler for execution

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks