Overview

overview

10

Static

static

f5c2308a61...3d.exe

windows7-x64

10

f5c2308a61...3d.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f5c2308a61ec4340c0c0acfa76d055219af805d511197a826531e6f7f0c0263d

  • Size

    4.2MB

  • Sample

    221129-br661saf6s

  • MD5

    4d7d8ac837650c855e1e8c7906947ef6

  • SHA1

    a4dedd6894536f76bae99fa2c034a1be5015308c

  • SHA256

    f5c2308a61ec4340c0c0acfa76d055219af805d511197a826531e6f7f0c0263d

  • SHA512

    9674eed9e4efd647a644bf2520dbf8f7ef0b434b558f58a141553c1b0a279fe614cf3a9e21df5b3b3b32cc82c34db78c3cf7c89c0fe31839140a5f8e30c67ab7

  • SSDEEP

    98304:ful+CxSktOO7BOBsGstsuGRZsi0/mh/ZMFidqll5UoL27wnvvMo+A:mlLx5F6sGstiyilwod4UoLyws+

Score
10/10
isrstealerspywarestealertrojanupx

Malware Config

Targets

    • Target

      f5c2308a61ec4340c0c0acfa76d055219af805d511197a826531e6f7f0c0263d

    • Size

      4.2MB

    • MD5

      4d7d8ac837650c855e1e8c7906947ef6

    • SHA1

      a4dedd6894536f76bae99fa2c034a1be5015308c

    • SHA256

      f5c2308a61ec4340c0c0acfa76d055219af805d511197a826531e6f7f0c0263d

    • SHA512

      9674eed9e4efd647a644bf2520dbf8f7ef0b434b558f58a141553c1b0a279fe614cf3a9e21df5b3b3b32cc82c34db78c3cf7c89c0fe31839140a5f8e30c67ab7

    • SSDEEP

      98304:ful+CxSktOO7BOBsGstsuGRZsi0/mh/ZMFidqll5UoL27wnvvMo+A:mlLx5F6sGstiyilwod4UoLyws+

    Score
    10/10
    isrstealerspywarestealertrojanupx

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks