isrstealer | 2283f27b3f3352679c711b9f7eeb4461 | Triage

Sharing

General

Target

2283f27b3f3352679c711b9f7eeb4461
Size

24KB
MD5

2283f27b3f3352679c711b9f7eeb4461
SHA1

cd3573a81cf86f570669c79e4913dec353932586
SHA256

5eda2ffc0faeba3d0c2b83e4b3ae233f1ed4d0fd9116b0fb7118320cdc8abace
SHA512

83a9c2dff7984dc83bb9f7786056bc6ab629eb466b632ee23e9eeed855ae16736bcdf6ad56b27d94ca4fe9cdcff36f4f76d71a6b3dc0afa09adc6baa4c44b529
SSDEEP

384:v0PTng7XM2X9ntzw4kPX8SPqkiTz6jLPRzwk:vuTgLM2X91uPEz6jLPRzn

Score

10^/10

isrstealer

Malware Config

Signatures

ISR Stealer payload 1 IoCs

Processes:

resource yara_rule

sample family_isrstealer
Isrstealer family
isrstealer
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

2283f27b3f3352679c711b9f7eeb4461

Files

2283f27b3f3352679c711b9f7eeb4461
.exe windows:4 windows x86 arch:x86

193669adbcc65a07a9715dd4832f10ce

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

MethCallEngine
ord516
ord666
ord667
ord520
ord631
ord526
EVENT_SINK_AddRef
ord529
DllFunctionCall
EVENT_SINK_Release
ord601
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
ord712
ord606
ord607
ord608
ord717
ProcCallEngine
ord537
ord644
ord645
ord570
ord648
ord571
ord100
ord616

Sections

.text
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 176KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ