General

  • Target

    77f0b068f71311ce1430d195a286b407d6d3c8f475bc3c28fb2daa387eea94bc

  • Size

    613KB

  • Sample

    221130-qwdgtshb3y

  • MD5

    15735b6138ce6e6e570337583cbe35d0

  • SHA1

    324cd39f6bdeb4aed2c269d2ed0dda967b3f0320

  • SHA256

    77f0b068f71311ce1430d195a286b407d6d3c8f475bc3c28fb2daa387eea94bc

  • SHA512

    00d9586e510a3e29c2069bd49e710c2280d5a1eea196f1d2bb8cf62db897114ae0534c696a66be9ec10811861014b0bb62cad21ba00ecdf99811a10b9c65eabb

  • SSDEEP

    12288:kRmL9rS+IOXesSx9/t1VDA0XV1ZHwu8EMJbahjgq+H1Zd:Ww9S3d+MHwu+bKqH1H

Malware Config

Targets

    • Target

      77f0b068f71311ce1430d195a286b407d6d3c8f475bc3c28fb2daa387eea94bc

    • Size

      613KB

    • MD5

      15735b6138ce6e6e570337583cbe35d0

    • SHA1

      324cd39f6bdeb4aed2c269d2ed0dda967b3f0320

    • SHA256

      77f0b068f71311ce1430d195a286b407d6d3c8f475bc3c28fb2daa387eea94bc

    • SHA512

      00d9586e510a3e29c2069bd49e710c2280d5a1eea196f1d2bb8cf62db897114ae0534c696a66be9ec10811861014b0bb62cad21ba00ecdf99811a10b9c65eabb

    • SSDEEP

      12288:kRmL9rS+IOXesSx9/t1VDA0XV1ZHwu8EMJbahjgq+H1Zd:Ww9S3d+MHwu+bKqH1H

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

    • ISR Stealer payload

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • Nirsoft

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks