isrstealer | 237a93b6f64c1f79a1599610f3e8566d903557199a0a0d2298265d12fb9d69eb

General

Target

237a93b6f64c1f79a1599610f3e8566d903557199a0a0d2298265d12fb9d69eb
Size

4.3MB
Sample

221202-zkq38agb9t
MD5

3e2c8e82a903d590ec1e77da118ba422
SHA1

048f4fcb2f67cd5e530834e9517401fac4716fe7
SHA256

237a93b6f64c1f79a1599610f3e8566d903557199a0a0d2298265d12fb9d69eb
SHA512

e50cd2d0c34a2b742a3f6d5911a83263c4d1378149ca956011a64ae0c326ed06b6300ddcd74525ed64f9e893a41fd78c61ed091fdc6cec1da422615a2893bb68
SSDEEP

98304:TrOUtpIu0ahhViYC/+tpfX7L320/DJ55qbZ8miDtAdh8tS5:Xntmu04riYA+tpjLb15PmiDtih8tS

Score

10^/10

Malware Config

Targets

- Target
  
  237a93b6f64c1f79a1599610f3e8566d903557199a0a0d2298265d12fb9d69eb
- Size
  
  4.3MB
- MD5
  
  3e2c8e82a903d590ec1e77da118ba422
- SHA1
  
  048f4fcb2f67cd5e530834e9517401fac4716fe7
- SHA256
  
  237a93b6f64c1f79a1599610f3e8566d903557199a0a0d2298265d12fb9d69eb
- SHA512
  
  e50cd2d0c34a2b742a3f6d5911a83263c4d1378149ca956011a64ae0c326ed06b6300ddcd74525ed64f9e893a41fd78c61ed091fdc6cec1da422615a2893bb68
- SSDEEP
  
  98304:TrOUtpIu0ahhViYC/+tpfX7L320/DJ55qbZ8miDtAdh8tS5:Xntmu04riYA+tpjLb15PmiDtih8tS
Score

10^/10

isrstealer persistence spyware stealer trojan upx
- ISR Stealer
  ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
  trojan stealer isrstealer
- ISR Stealer payload
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

ISR Stealer

ISR Stealer payload

Executes dropped EXE

UPX packed file

Loads dropped DLL

Reads user/profile data of web browsers

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2