Overview

overview

10

Static

static

3

09d716d57e...54.exe

windows7-x64

10

09d716d57e...54.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    09d716d57edc76d03136a0c475126554

  • Size

    312KB

  • Sample

    231230-bn6q3sbfd8

  • MD5

    09d716d57edc76d03136a0c475126554

  • SHA1

    cb92a0c2a030ab46da68688dc257f3635b8f8783

  • SHA256

    622f6d37e73da72ea2d39f77099ee466e5979e47e1c55c0062855abae923f121

  • SHA512

    7ea2e93a807f417307f29a5b552bfd53426206cc8712513c7e4e96d3d2501a75a4c42496d09560b10f6abfdace0e5fae3a106df828a2e691bc43fed86e58ae46

  • SSDEEP

    6144:RLa94GN7fiIEAeLHJx01zfs/RjX2cDEuNRxBxCH8e+nHZJlH9V/Eh5zsDjX25hGq:RW94GN7fiIEAeLHJx0VoVsu9CceOJlDe

Score
10/10
isrstealerbootkitpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      09d716d57edc76d03136a0c475126554

    • Size

      312KB

    • MD5

      09d716d57edc76d03136a0c475126554

    • SHA1

      cb92a0c2a030ab46da68688dc257f3635b8f8783

    • SHA256

      622f6d37e73da72ea2d39f77099ee466e5979e47e1c55c0062855abae923f121

    • SHA512

      7ea2e93a807f417307f29a5b552bfd53426206cc8712513c7e4e96d3d2501a75a4c42496d09560b10f6abfdace0e5fae3a106df828a2e691bc43fed86e58ae46

    • SSDEEP

      6144:RLa94GN7fiIEAeLHJx01zfs/RjX2cDEuNRxBxCH8e+nHZJlH9V/Eh5zsDjX25hGq:RW94GN7fiIEAeLHJx0VoVsu9CceOJlDe

    Score
    10/10
    isrstealerbootkitpersistencespywarestealertrojan

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks