isrstealer | a17ec5e62cf5470c57644c416fda98054c652453df9a4c3024f532b32b7ef467

General

Target

a17ec5e62cf5470c57644c416fda98054c652453df9a4c3024f532b32b7ef467
Size

648KB
Sample

221129-t9z5jaaf5t
MD5

cd443bced7b6bb622996d5094bc2efa5
SHA1

1abf435e863f5ed9c6410cf411bda86847302791
SHA256

a17ec5e62cf5470c57644c416fda98054c652453df9a4c3024f532b32b7ef467
SHA512

7978825ab7b4a106986379b38498b184bc6da81200a743072b36ea5a98d365133cf307d75ee981c3f332d465eda5126d2235f6dc7d7f4538e4cc4f8697ad42d7
SSDEEP

12288:MtLb0Rb/Eba3gNSV2TgoV4G+RG9arpUxhElrcaSt2aKO5XiYHxU:0Lb0RbqSr72aryxScNtAO5yYH2

Score

10^/10

Malware Config

Targets

- Target
  
  a17ec5e62cf5470c57644c416fda98054c652453df9a4c3024f532b32b7ef467
- Size
  
  648KB
- MD5
  
  cd443bced7b6bb622996d5094bc2efa5
- SHA1
  
  1abf435e863f5ed9c6410cf411bda86847302791
- SHA256
  
  a17ec5e62cf5470c57644c416fda98054c652453df9a4c3024f532b32b7ef467
- SHA512
  
  7978825ab7b4a106986379b38498b184bc6da81200a743072b36ea5a98d365133cf307d75ee981c3f332d465eda5126d2235f6dc7d7f4538e4cc4f8697ad42d7
- SSDEEP
  
  12288:MtLb0Rb/Eba3gNSV2TgoV4G+RG9arpUxhElrcaSt2aKO5XiYHxU:0Lb0RbqSr72aryxScNtAO5yYH2
Score

10^/10

isrstealer collection spyware stealer trojan upx
- ISR Stealer
  ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
  trojan stealer isrstealer
- ISR Stealer payload
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2