Overview

overview

10

Static

static

3

e116864cc4...JC.exe

windows7-x64

10

e116864cc4...JC.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e116864cc4443f4179cd0938dd0ef49a4217e66ca3534d4d96bdd0d54f17ff0d_JC.exe

  • Size

    863KB

  • Sample

    230924-rpcsdshd77

  • MD5

    8c57dda2b134801321a87c65cfb4fd85

  • SHA1

    177ef72837380cff667111373695138decc972f3

  • SHA256

    e116864cc4443f4179cd0938dd0ef49a4217e66ca3534d4d96bdd0d54f17ff0d

  • SHA512

    5642c315cec341fd0c9a63a27d43971bcd62960d45a778dddcfde7cba8881a430566f2f6a7e7897c7252edad1651c2fadfde047b4e904ff3840f3f3472f12d4a

  • SSDEEP

    24576:P2O/GlsQSLG/5vEprm6QTkw7g6zwm4m53Sb2xIJ:GSLLmJkw5kFm53SyxIJ

Score
10/10
isrstealercollectionpersistencestealertrojanupx

Malware Config

Targets

    • Target

      e116864cc4443f4179cd0938dd0ef49a4217e66ca3534d4d96bdd0d54f17ff0d_JC.exe

    • Size

      863KB

    • MD5

      8c57dda2b134801321a87c65cfb4fd85

    • SHA1

      177ef72837380cff667111373695138decc972f3

    • SHA256

      e116864cc4443f4179cd0938dd0ef49a4217e66ca3534d4d96bdd0d54f17ff0d

    • SHA512

      5642c315cec341fd0c9a63a27d43971bcd62960d45a778dddcfde7cba8881a430566f2f6a7e7897c7252edad1651c2fadfde047b4e904ff3840f3f3472f12d4a

    • SSDEEP

      24576:P2O/GlsQSLG/5vEprm6QTkw7g6zwm4m53Sb2xIJ:GSLLmJkw5kFm53SyxIJ

    Score
    10/10
    isrstealerpersistencestealertrojancollectionupx

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • Nirsoft

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks