General

  • Target

    c0492b15c6325d42de72a7ed155f957e41598e210a1b4d1c902211f0b8f55d64

  • Size

    1024KB

  • Sample

    221203-gmnrrsad76

  • MD5

    945d2748f16fda917ffc2692a42002ab

  • SHA1

    cc34c154813be71ecfa7cbae082501932ba8e01d

  • SHA256

    c0492b15c6325d42de72a7ed155f957e41598e210a1b4d1c902211f0b8f55d64

  • SHA512

    d140d5533db7adbb994524047bf29ae045289ce09d8e653290bac0cadacc9810e8eea33a3d28c9b47c6410f39b50314ea0db7e74208efc7cef314ec214be99e1

  • SSDEEP

    12288:S0MN2KmANaNWY3JwN3rSA1cYBuOlIh1JhNAHatgl6:S0wAANaN7mXb7lcr0

Malware Config

Targets

    • Target

      c0492b15c6325d42de72a7ed155f957e41598e210a1b4d1c902211f0b8f55d64

    • Size

      1024KB

    • MD5

      945d2748f16fda917ffc2692a42002ab

    • SHA1

      cc34c154813be71ecfa7cbae082501932ba8e01d

    • SHA256

      c0492b15c6325d42de72a7ed155f957e41598e210a1b4d1c902211f0b8f55d64

    • SHA512

      d140d5533db7adbb994524047bf29ae045289ce09d8e653290bac0cadacc9810e8eea33a3d28c9b47c6410f39b50314ea0db7e74208efc7cef314ec214be99e1

    • SSDEEP

      12288:S0MN2KmANaNWY3JwN3rSA1cYBuOlIh1JhNAHatgl6:S0wAANaN7mXb7lcr0

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

    • ISR Stealer payload

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks