Overview

overview

10

Static

static

435e94a69c...a6.exe

windows7-x64

10

435e94a69c...a6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    435e94a69cf878fcfb98b016a9477a7ac3714d596473d1d84d485d6f347803a6

  • Size

    24.1MB

  • Sample

    221203-b7v4padg88

  • MD5

    a4aa0526bcfab4393cbe31991b6c3a20

  • SHA1

    fa3f78909efa1f5b84ee378a74bd45ea461e018f

  • SHA256

    435e94a69cf878fcfb98b016a9477a7ac3714d596473d1d84d485d6f347803a6

  • SHA512

    dc27e9da39436f117787f605de0ecb52f0f520198fc6b67ffd13490051213a6084c7f8bdafd311ab7ec61d4565d4dbd3e909419c0ec328e1d9c44b55d81d222b

  • SSDEEP

    98304:Z8QL5gL7rtWrIsR4Qos05TQ99pRRD38/6:ZZdgIl05+RRT8/

Score
10/10
isrstealerpersistencestealertrojanupx

Malware Config

Targets

    • Target

      435e94a69cf878fcfb98b016a9477a7ac3714d596473d1d84d485d6f347803a6

    • Size

      24.1MB

    • MD5

      a4aa0526bcfab4393cbe31991b6c3a20

    • SHA1

      fa3f78909efa1f5b84ee378a74bd45ea461e018f

    • SHA256

      435e94a69cf878fcfb98b016a9477a7ac3714d596473d1d84d485d6f347803a6

    • SHA512

      dc27e9da39436f117787f605de0ecb52f0f520198fc6b67ffd13490051213a6084c7f8bdafd311ab7ec61d4565d4dbd3e909419c0ec328e1d9c44b55d81d222b

    • SSDEEP

      98304:Z8QL5gL7rtWrIsR4Qos05TQ99pRRD38/6:ZZdgIl05+RRT8/

    Score
    10/10
    isrstealerpersistencestealertrojanupx

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks