Overview

overview

10

Static

static

7b5f23eeaa...64.exe

windows7-x64

10

7b5f23eeaa...64.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7b5f23eeaa859056b764e21e1749980f40ab2a2237d4b7feb6c9f2574ad81364

  • Size

    2.6MB

  • Sample

    221203-g8mftsca95

  • MD5

    b2894f2cbe96e7354f45c92dbc81a6b2

  • SHA1

    c11da9d91173628a9557e9a7950f6b1504afd8db

  • SHA256

    7b5f23eeaa859056b764e21e1749980f40ab2a2237d4b7feb6c9f2574ad81364

  • SHA512

    d44011b7f32b06f1d702c9270b106642a7b5c25fd15764cafb14f2dcf2ba6e1909b2b873bede3d9dee627843fa2733e18042f7e267dc5fa7a27835b87ed3fdf4

  • SSDEEP

    24576:YHYxbvHwDr6Y/Hicgp/lUBXHYxbvHwDr6Y/Hicgp/lUBhshRdrEAbm4z:Y4xcD/6h0BX4xcD/6h0BhydYAm4z

Score
10/10
isrstealercollectionspywarestealertrojanupx

Malware Config

Targets

    • Target

      7b5f23eeaa859056b764e21e1749980f40ab2a2237d4b7feb6c9f2574ad81364

    • Size

      2.6MB

    • MD5

      b2894f2cbe96e7354f45c92dbc81a6b2

    • SHA1

      c11da9d91173628a9557e9a7950f6b1504afd8db

    • SHA256

      7b5f23eeaa859056b764e21e1749980f40ab2a2237d4b7feb6c9f2574ad81364

    • SHA512

      d44011b7f32b06f1d702c9270b106642a7b5c25fd15764cafb14f2dcf2ba6e1909b2b873bede3d9dee627843fa2733e18042f7e267dc5fa7a27835b87ed3fdf4

    • SSDEEP

      24576:YHYxbvHwDr6Y/Hicgp/lUBXHYxbvHwDr6Y/Hicgp/lUBhshRdrEAbm4z:Y4xcD/6h0BX4xcD/6h0BhydYAm4z

    Score
    10/10
    isrstealercollectionspywarestealertrojanupx

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • Nirsoft

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks