Overview

overview

10

Static

static

d21e0a13be...7e.exe

windows7-x64

10

d21e0a13be...7e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d21e0a13be0061653b88d7a5c62299f7658ff7f82e372760233ba775622a997e

  • Size

    1.7MB

  • Sample

    221129-p2z3caaf84

  • MD5

    8e909b372d7d2e2dd9c4009860353785

  • SHA1

    49980560942fb08f9682f5f5f9fc9776f25c4ea3

  • SHA256

    d21e0a13be0061653b88d7a5c62299f7658ff7f82e372760233ba775622a997e

  • SHA512

    8ce9c2e5f1d2eb6e00f2dc95d1c13c3de455017bdd5ca1547751ad5fe686f88833bfcd9e5daf57c3d0cc32d3e3def917138cf5728a15034b57fbeff137e35bac

  • SSDEEP

    49152:30cWXWjEJJ83Os4Gi1t4bdvBUgTGLxiuZ7t:35+qEr837/HExiuZB

Score
10/10
isrstealerstealertrojan

Malware Config

Targets

    • Target

      d21e0a13be0061653b88d7a5c62299f7658ff7f82e372760233ba775622a997e

    • Size

      1.7MB

    • MD5

      8e909b372d7d2e2dd9c4009860353785

    • SHA1

      49980560942fb08f9682f5f5f9fc9776f25c4ea3

    • SHA256

      d21e0a13be0061653b88d7a5c62299f7658ff7f82e372760233ba775622a997e

    • SHA512

      8ce9c2e5f1d2eb6e00f2dc95d1c13c3de455017bdd5ca1547751ad5fe686f88833bfcd9e5daf57c3d0cc32d3e3def917138cf5728a15034b57fbeff137e35bac

    • SSDEEP

      49152:30cWXWjEJJ83Os4Gi1t4bdvBUgTGLxiuZ7t:35+qEr837/HExiuZB

    Score
    10/10
    isrstealerstealertrojan

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks