isrstealer | 7159dc8eee8e2cfbeb071acc877a4f499cd0110146311f045b0279f0a77047ff

General

Target

7159dc8eee8e2cfbeb071acc877a4f499cd0110146311f045b0279f0a77047ff
Size

1.1MB
Sample

221130-kz22psfb49
MD5

7d1cc2d002bae3faebd68f653cd4273f
SHA1

1151f7fb080c0d24785bbcb63868757f7598fc57
SHA256

7159dc8eee8e2cfbeb071acc877a4f499cd0110146311f045b0279f0a77047ff
SHA512

6011e19b15b7f00b8011608da316667cef50fb760528b554e7a8182d6ea037a468f134a9a9c9063f9aea659b02183fe14ea7208a839e0d990e06229250ab23fc
SSDEEP

12288:m/O2MP+/sybq5p3hQxz9qKav7CSfnfmC7Bl04eMQWLNSMjc2OfbXqqE0K17FP7uw:Nr0U30a+SDrpjOfN/KLDj

Score

10^/10

Malware Config

Targets

- Target
  
  7159dc8eee8e2cfbeb071acc877a4f499cd0110146311f045b0279f0a77047ff
- Size
  
  1.1MB
- MD5
  
  7d1cc2d002bae3faebd68f653cd4273f
- SHA1
  
  1151f7fb080c0d24785bbcb63868757f7598fc57
- SHA256
  
  7159dc8eee8e2cfbeb071acc877a4f499cd0110146311f045b0279f0a77047ff
- SHA512
  
  6011e19b15b7f00b8011608da316667cef50fb760528b554e7a8182d6ea037a468f134a9a9c9063f9aea659b02183fe14ea7208a839e0d990e06229250ab23fc
- SSDEEP
  
  12288:m/O2MP+/sybq5p3hQxz9qKav7CSfnfmC7Bl04eMQWLNSMjc2OfbXqqE0K17FP7uw:Nr0U30a+SDrpjOfN/KLDj
Score

10^/10

isrstealer collection persistence spyware stealer trojan upx
- ISR Stealer
  ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
  trojan stealer isrstealer
- ISR Stealer payload
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2