isrstealer | 0c328b00fd4cad09fafcacfb8fa6d5c4d93368a4f4d5447761750277dc008282 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

7

0c328b00fd...82.exe

windows7-x64

0c328b00fd...82.exe

windows10-2004-x64

Sharing

General

Target

0c328b00fd4cad09fafcacfb8fa6d5c4d93368a4f4d5447761750277dc008282
Size

1012KB
Sample

221128-w19zgsfc88
MD5

8807ef7bf3e5259c6ce9cb1eb168c77b
SHA1

d44898854fbacacba34f064d57c4fa88223a6747
SHA256

0c328b00fd4cad09fafcacfb8fa6d5c4d93368a4f4d5447761750277dc008282
SHA512

756ce8d1db71e0c15c77521357b631f7ad7e79b465b3d34c9c9e7bc5d57404740c07bc0db9fea29d5b0e6131f23e41ffa9531c5e902bd8a5e611743fb74d5b66
SSDEEP

24576:Q6gh1zkTrXaiSjhbEngC8v48ZKSUL3hxG1K0gDzfTvTB0UJk4u4Qz5/CmWLX7U:rQniSjhbEgCcZKpdv9VW40zVUL

Score

10^/10

isrstealer agilenet collection stealer trojan upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

0c328b00fd4cad09fafcacfb8fa6d5c4d93368a4f4d5447761750277dc008282.exe

Resource

win7-20220901-en

isrstealer collection stealer trojan upx

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

0c328b00fd4cad09fafcacfb8fa6d5c4d93368a4f4d5447761750277dc008282.exe

Resource

win10v2004-20220901-en

isrstealer collection stealer trojan upx

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  0c328b00fd4cad09fafcacfb8fa6d5c4d93368a4f4d5447761750277dc008282
- Size
  
  1012KB
- MD5
  
  8807ef7bf3e5259c6ce9cb1eb168c77b
- SHA1
  
  d44898854fbacacba34f064d57c4fa88223a6747
- SHA256
  
  0c328b00fd4cad09fafcacfb8fa6d5c4d93368a4f4d5447761750277dc008282
- SHA512
  
  756ce8d1db71e0c15c77521357b631f7ad7e79b465b3d34c9c9e7bc5d57404740c07bc0db9fea29d5b0e6131f23e41ffa9531c5e902bd8a5e611743fb74d5b66
- SSDEEP
  
  24576:Q6gh1zkTrXaiSjhbEngC8v48ZKSUL3hxG1K0gDzfTvTB0UJk4u4Qz5/CmWLX7U:rQniSjhbEgCcZKpdv9VW40zVUL
Score

10^/10

isrstealer collection stealer trojan upx
- ISR Stealer
  ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
  trojan stealer isrstealer
- ISR Stealer payload
- NirSoft MailPassView
  Password recovery tool for various email clients
- Nirsoft
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

isrstealercollectionstealertrojanupx

behavioral2

isrstealercollectionstealertrojanupx

© 2018-2025

Terms | Privacy