isrstealer | de464519d92957e77998135284148e32b4097f51e980084d587ec8fdcacf6ccc

General

Target

de464519d92957e77998135284148e32b4097f51e980084d587ec8fdcacf6ccc
Size

535KB
Sample

221129-bsa5zafa38
MD5

180f21c876bcf411fc6be43f1871072d
SHA1

25767211bcf64f387ecdc74f512ff2a99a6f0cc8
SHA256

de464519d92957e77998135284148e32b4097f51e980084d587ec8fdcacf6ccc
SHA512

8d449a14076268905a87f3a9b1edc99e55af550bc6e8874532fb6e9b6804d1de3c27f218d6e1eb006b9ff66c5172f46794567b3f266cd2dd75ff046a0c046785
SSDEEP

12288:8Blq9I8/ZdkB7qeGvRHHVlXqgGzP+4WvX5nxzpsBc8gdlLGc/:83qi8ANGZH6RT+L9xaBc8gac/

Score

10^/10

Malware Config

Targets

- Target
  
  de464519d92957e77998135284148e32b4097f51e980084d587ec8fdcacf6ccc
- Size
  
  535KB
- MD5
  
  180f21c876bcf411fc6be43f1871072d
- SHA1
  
  25767211bcf64f387ecdc74f512ff2a99a6f0cc8
- SHA256
  
  de464519d92957e77998135284148e32b4097f51e980084d587ec8fdcacf6ccc
- SHA512
  
  8d449a14076268905a87f3a9b1edc99e55af550bc6e8874532fb6e9b6804d1de3c27f218d6e1eb006b9ff66c5172f46794567b3f266cd2dd75ff046a0c046785
- SSDEEP
  
  12288:8Blq9I8/ZdkB7qeGvRHHVlXqgGzP+4WvX5nxzpsBc8gdlLGc/:83qi8ANGZH6RT+L9xaBc8gac/
Score

10^/10

isrstealer collection spyware stealer trojan upx
- ISR Stealer
  ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
  trojan stealer isrstealer
- ISR Stealer payload
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2