Overview

overview

10

Static

static

f3fd9c235e...04.exe

windows7-x64

10

f3fd9c235e...04.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f3fd9c235e6f11f911792ca6e3c3fa9fc34b197683e48e31a13b95f4ac2f5d04

  • Size

    628KB

  • Sample

    221202-zewrhscb29

  • MD5

    28fb38eebace1b05bf85fcce055de30d

  • SHA1

    f19928ad277eb151b5f3acb84a6d374b6104c2a0

  • SHA256

    f3fd9c235e6f11f911792ca6e3c3fa9fc34b197683e48e31a13b95f4ac2f5d04

  • SHA512

    318126d77a2cc801fe9392a4cf7f8ef585421d57e0c82e2d96696df4c42a7c8082a534cbf6d427c9cd2c647c15846f39090ca74677fe660a5892a5fc0210443b

  • SSDEEP

    12288:GrsrkkM3BPgVryyifXh8HCQrB5tRjKTJLF3cJlKuvT:Gi49ysunrrP8x3cJlKu7

Score
10/10
isrstealercollectionspywarestealertrojanupx

Malware Config

Targets

    • Target

      f3fd9c235e6f11f911792ca6e3c3fa9fc34b197683e48e31a13b95f4ac2f5d04

    • Size

      628KB

    • MD5

      28fb38eebace1b05bf85fcce055de30d

    • SHA1

      f19928ad277eb151b5f3acb84a6d374b6104c2a0

    • SHA256

      f3fd9c235e6f11f911792ca6e3c3fa9fc34b197683e48e31a13b95f4ac2f5d04

    • SHA512

      318126d77a2cc801fe9392a4cf7f8ef585421d57e0c82e2d96696df4c42a7c8082a534cbf6d427c9cd2c647c15846f39090ca74677fe660a5892a5fc0210443b

    • SSDEEP

      12288:GrsrkkM3BPgVryyifXh8HCQrB5tRjKTJLF3cJlKuvT:Gi49ysunrrP8x3cJlKu7

    Score
    10/10
    isrstealercollectionspywarestealertrojanupx

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks