isrstealer | a32d22f89504c7f9a3cc2f430224c960a5aa0c753b489cee5fcd8c154fc5ae15

General

Target

a32d22f89504c7f9a3cc2f430224c960a5aa0c753b489cee5fcd8c154fc5ae15
Size

1.2MB
Sample

221128-mwb28agf22
MD5

b0b79d5e2dd2ce09c9f2655bd71d83ad
SHA1

2a774db55ec01dc5ce45ef4aec52866e7f343bd2
SHA256

a32d22f89504c7f9a3cc2f430224c960a5aa0c753b489cee5fcd8c154fc5ae15
SHA512

ce813cbf7c52c283e49c929c43cb4becf6713f8f0bdd3901aa942d64aca5f9229fc59e6065fade5a6be7a7febf4e4d5ab15d7a6a634f254f76788fdf28dcdde2
SSDEEP

12288:XER+26GtTK9bc8XgFCO8h4uG0hMcnfxIQZ+4Ka6x5rh3HU0H:w6q+J/XgFCt4uG0eAWQZ+4h+00H

Score

10^/10

Malware Config

Extracted

Family

pony

C2

http://kalunta.esy.es/pony/gate.php

Attributes

payload_url
http://kalunta.esy.es/pony/kalu.exe

Targets

- Target
  
  a32d22f89504c7f9a3cc2f430224c960a5aa0c753b489cee5fcd8c154fc5ae15
- Size
  
  1.2MB
- MD5
  
  b0b79d5e2dd2ce09c9f2655bd71d83ad
- SHA1
  
  2a774db55ec01dc5ce45ef4aec52866e7f343bd2
- SHA256
  
  a32d22f89504c7f9a3cc2f430224c960a5aa0c753b489cee5fcd8c154fc5ae15
- SHA512
  
  ce813cbf7c52c283e49c929c43cb4becf6713f8f0bdd3901aa942d64aca5f9229fc59e6065fade5a6be7a7febf4e4d5ab15d7a6a634f254f76788fdf28dcdde2
- SSDEEP
  
  12288:XER+26GtTK9bc8XgFCO8h4uG0hMcnfxIQZ+4Ka6x5rh3HU0H:w6q+J/XgFCt4uG0eAWQZ+4h+00H
Score

10^/10

isrstealer netwire pony botnet collection discovery rat spyware stealer trojan upx
- ISR Stealer
  ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
  trojan stealer isrstealer
- ISR Stealer payload
- NetWire RAT payload
  rat
- Netwire
  Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
  botnet stealer netwire
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- NirSoft MailPassView
  Password recovery tool for various email clients
- Nirsoft
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2