Overview

overview

10

Static

static

8bae67b82b...5c.exe

windows7-x64

10

8bae67b82b...5c.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8bae67b82bddf673f57fa8015f5af666d0dbd1eac8ad3b3aa405a8f65d21d05c

  • Size

    667KB

  • Sample

    221207-m9wc1sbb66

  • MD5

    516a920bc57b5ff29b68d3375cb896f2

  • SHA1

    603772696dbc927a5fc33ae6e70e0f9312ecd374

  • SHA256

    8bae67b82bddf673f57fa8015f5af666d0dbd1eac8ad3b3aa405a8f65d21d05c

  • SHA512

    a7e0d496752a7cf3ec6defbaa1ac8472cf2dfcf3490003af7b8c1ecc3d9970a9d73c071f7b8ff54db3e8e1c75f18797f12e8390746bce5cd75041882cabe8f57

  • SSDEEP

    12288:jtCtt8pdf8TWH9Ucl3X5BKYIiqQnKIt1s03NdY3333OdLLmqSwEFZb:jyt8phH9Ucla14nKr0ry3sLLT32Z

Score
10/10
isrstealercollectionspywarestealertrojanupx

Malware Config

Targets

    • Target

      8bae67b82bddf673f57fa8015f5af666d0dbd1eac8ad3b3aa405a8f65d21d05c

    • Size

      667KB

    • MD5

      516a920bc57b5ff29b68d3375cb896f2

    • SHA1

      603772696dbc927a5fc33ae6e70e0f9312ecd374

    • SHA256

      8bae67b82bddf673f57fa8015f5af666d0dbd1eac8ad3b3aa405a8f65d21d05c

    • SHA512

      a7e0d496752a7cf3ec6defbaa1ac8472cf2dfcf3490003af7b8c1ecc3d9970a9d73c071f7b8ff54db3e8e1c75f18797f12e8390746bce5cd75041882cabe8f57

    • SSDEEP

      12288:jtCtt8pdf8TWH9Ucl3X5BKYIiqQnKIt1s03NdY3333OdLLmqSwEFZb:jyt8phH9Ucla14nKr0ry3sLLT32Z

    Score
    10/10
    isrstealercollectionspywarestealertrojanupx

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks