Overview

overview

10

Static

static

3

7ba1d18562...d1.exe

windows7-x64

10

7ba1d18562...d1.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7ba1d18562d7219931228d66d4d5e4d1

  • Size

    513KB

  • Sample

    240128-acrbksfaf2

  • MD5

    7ba1d18562d7219931228d66d4d5e4d1

  • SHA1

    b4bd541564dc53bb38dd884c4853cdf035bc5dd5

  • SHA256

    08e8b75fb98b28e50863662508ed74de229fbc052923f8db05822861ae081d51

  • SHA512

    b433fbebf9b81ad42f86a1597b03eb427ac2c93b40aab73bf3eaf9df5786815782009d91d30b2234438f57b5c4cc1d7f94201e3e3d9b34b8339792a3bca697d2

  • SSDEEP

    12288:WcgFDJ6B42I08WbtJc7vmg41KU3ZE0D1msMf+su:p8AB42I0ntJc7vmg41bRHMf+s

Score
10/10
isrstealercollectionspywarestealertrojanupx

Malware Config

Targets

    • Target

      7ba1d18562d7219931228d66d4d5e4d1

    • Size

      513KB

    • MD5

      7ba1d18562d7219931228d66d4d5e4d1

    • SHA1

      b4bd541564dc53bb38dd884c4853cdf035bc5dd5

    • SHA256

      08e8b75fb98b28e50863662508ed74de229fbc052923f8db05822861ae081d51

    • SHA512

      b433fbebf9b81ad42f86a1597b03eb427ac2c93b40aab73bf3eaf9df5786815782009d91d30b2234438f57b5c4cc1d7f94201e3e3d9b34b8339792a3bca697d2

    • SSDEEP

      12288:WcgFDJ6B42I08WbtJc7vmg41KU3ZE0D1msMf+su:p8AB42I0ntJc7vmg41bRHMf+s

    Score
    10/10
    isrstealercollectionspywarestealertrojanupx

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • Nirsoft

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Accesses Microsoft Outlook accounts

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks