isrstealer | 788955fd1239eeda6405885c58f0a00edbcb9f3bd21d57f13e88712b82b8d9b4 | Triage

Sharing

General

Target

788955fd1239eeda6405885c58f0a00edbcb9f3bd21d57f13e88712b82b8d9b4
Size

332KB
MD5

ddf2d9be5ba7db3de27dfc92eb978580
SHA1

01d4f3e43aaf3c31565111bd40f85bb9d49f8841
SHA256

788955fd1239eeda6405885c58f0a00edbcb9f3bd21d57f13e88712b82b8d9b4
SHA512

ae6739f99ca1d403ecf7322f88c2db08cb7333c1ae3a3227615b8e3d89708105a660242db1875d0b19d6ae67bd9da1cd11ea1f188ee2928c8b317e48beafac26
SSDEEP

6144:iH8vnCm4/QrVeoichIaoL2Xh4f3uFf7P2QButMGQJ:kjQrdiSNoLshUuFj+UcQJ

Score

10^/10

isrstealer

Malware Config

Signatures

ISR Stealer payload 1 IoCs

resource	yara_rule
sample	family_isrstealer

Isrstealer family
isrstealer

Files

788955fd1239eeda6405885c58f0a00edbcb9f3bd21d57f13e88712b82b8d9b4
.exe windows x86

4547bdcd0c3c952cce7b1290dd98f06f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

MethCallEngine
ord516
ord517
ord518
ord519
ord661
ord666
ord667
ord592
ord598
ord520
ord631
ord525
ord632
ord526
EVENT_SINK_AddRef
ord528
ord561
DllFunctionCall
EVENT_SINK_Release
ord601
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
ord712
ord606
ord607
ord608
ord716
ord717
ProcCallEngine
ord537
ord644
ord538
ord645
ord648
ord570
ord571
ord572
ord681
ord100
ord579
ord616
ord617
ord618
ord619
ord650
ord581

Sections

.text
Size: 68KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 260KB - Virtual size: 258KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE