Extracted

• • Target

    018111e36651a7a4590818f65190a2f74278c9ac5a964506009c115bebc76ef8

  • Size

    1.3MB

  • MD5

    4753fe490e06759ed4af57c52959cde9

  • SHA1

    7fae7af36fc9fb30385cf462f397ebe738610eb0

  • SHA256

    018111e36651a7a4590818f65190a2f74278c9ac5a964506009c115bebc76ef8

  • SHA512

    70131ad6d76aa6d9a614731d8e9bf983d7819d97b40aafe6d8c5e93e608e2ba882cbd3b98574d7c73f7344b941682b225a36e29e61bb49f72304c431ca590f73

  • SSDEEP

    24576:KaHMv6Corjqny/Q5U0JW0fRqrSPy/2wP1aoUJ4:K1vqjd/Q5U0EiRI/2wdaA

  Score

  10^/10

  isrstealerstealertrojansalitybackdoorevasionspywareupx

  • ISR Stealer

    ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

    trojanstealerisrstealer

  • ISR Stealer payload

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2