isrstealer | 51a2ceee96b0ec3c5f2f664328a137ead527f786d82c75c8fc7249aeff161732 | Triage

Sharing

General

Target

51a2ceee96b0ec3c5f2f664328a137ead527f786d82c75c8fc7249aeff161732
Size

264KB
MD5

563857ae240c2970b20d8335ac95a375
SHA1

63e235fd5acdca33d08cd2c75331eeb1bc25e235
SHA256

51a2ceee96b0ec3c5f2f664328a137ead527f786d82c75c8fc7249aeff161732
SHA512

2ae6b413d350c63fa0722dbd9a1cf41d79e8dddb464efa0226fe63c5197797d348f7a726b83552af933bdc79f461d5f6c52191dd02f6da952be5ea64ce8984fe
SSDEEP

6144:8sRPRwtdIKCC0ef//uXltKc+LVsz9b8q:4tdFeCXuLKcCVsz6q

Score

10^/10

isrstealer

Malware Config

Signatures

ISR Stealer payload 1 IoCs

resource	yara_rule
sample	family_isrstealer

Isrstealer family
isrstealer

Files

51a2ceee96b0ec3c5f2f664328a137ead527f786d82c75c8fc7249aeff161732
.exe windows x86

14bced7848efce8ac7301bf0b659764e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

MethCallEngine
ord516
ord666
ord667
ord520
ord631
ord525
ord526
EVENT_SINK_AddRef
ord529
DllFunctionCall
EVENT_SINK_Release
ord601
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
ord712
ord606
ord607
ord608
ord717
ProcCallEngine
ord644
ord537
ord645
ord570
ord648
ord571
ord100
ord616

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 240KB - Virtual size: 238KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ