Overview

overview

10

Static

static

ba3e057e7a...40.exe

windows7-x64

10

ba3e057e7a...40.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ba3e057e7a823f18733de4b2514968c0e4c95ee146e1235ef583c2ea28fc3b40

  • Size

    1.1MB

  • Sample

    221201-h668wsag2x

  • MD5

    442987d5f387683241f0fc4451d6505f

  • SHA1

    763925e690da9c4ac9e354d3e974db30149bd9f5

  • SHA256

    ba3e057e7a823f18733de4b2514968c0e4c95ee146e1235ef583c2ea28fc3b40

  • SHA512

    b1e3c596d42116e7d014c76de1c868faf86f078a7d102549b84e715d5ac131bcbdbebcb1168e3e1318c7e0774010d50b7a35fa785d7b04f929e1efc1b9c9d641

  • SSDEEP

    24576:Vm9x+JQdTqQ4i8EbtPcFWO0j8ksr7Sk4Lg9eDBbt8dTqQ4iMW:6tTqQ4irPcFOjz67Sk4rVbteTqQ4iMW

Score
10/10
isrstealerspywarestealertrojan

Malware Config

Targets

    • Target

      ba3e057e7a823f18733de4b2514968c0e4c95ee146e1235ef583c2ea28fc3b40

    • Size

      1.1MB

    • MD5

      442987d5f387683241f0fc4451d6505f

    • SHA1

      763925e690da9c4ac9e354d3e974db30149bd9f5

    • SHA256

      ba3e057e7a823f18733de4b2514968c0e4c95ee146e1235ef583c2ea28fc3b40

    • SHA512

      b1e3c596d42116e7d014c76de1c868faf86f078a7d102549b84e715d5ac131bcbdbebcb1168e3e1318c7e0774010d50b7a35fa785d7b04f929e1efc1b9c9d641

    • SSDEEP

      24576:Vm9x+JQdTqQ4i8EbtPcFWO0j8ksr7Sk4Lg9eDBbt8dTqQ4iMW:6tTqQ4irPcFOjz67Sk4rVbteTqQ4iMW

    Score
    10/10
    isrstealerspywarestealertrojan

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks