Overview

overview

10

Static

static

1

20183e5537...0N.exe

windows7-x64

10

20183e5537...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    20183e553792ae6197e8c687be18a66f742c03f7a4f056104352c01b43832590N.exe

  • Size

    768KB

  • Sample

    240926-bvvbmaygnm

  • MD5

    709f31cce8fb596fb211ecb532ac3320

  • SHA1

    0b4fd56473ade74d74d3831fe4674188a0623971

  • SHA256

    20183e553792ae6197e8c687be18a66f742c03f7a4f056104352c01b43832590

  • SHA512

    65fef446f3bbb1b1047f2537021977573eeb6d854a753e6c479035880022eef6164ad42535239acf4145411d533f5692d37e939bec7eaeea25a92beadbbae436

  • SSDEEP

    6144:mgxilHZyojpSVOfkNvR/XwSFXHw5sKxGhjuZxerwfJcWVPwt+Verd1cIJYvvB:2lYkCRv5FX8sKxGhyyk6TcIJYvvB

Score
10/10
isrstealerdiscoverypersistencestealertrojan

Malware Config

Targets

    • Target

      20183e553792ae6197e8c687be18a66f742c03f7a4f056104352c01b43832590N.exe

    • Size

      768KB

    • MD5

      709f31cce8fb596fb211ecb532ac3320

    • SHA1

      0b4fd56473ade74d74d3831fe4674188a0623971

    • SHA256

      20183e553792ae6197e8c687be18a66f742c03f7a4f056104352c01b43832590

    • SHA512

      65fef446f3bbb1b1047f2537021977573eeb6d854a753e6c479035880022eef6164ad42535239acf4145411d533f5692d37e939bec7eaeea25a92beadbbae436

    • SSDEEP

      6144:mgxilHZyojpSVOfkNvR/XwSFXHw5sKxGhjuZxerwfJcWVPwt+Verd1cIJYvvB:2lYkCRv5FX8sKxGhyyk6TcIJYvvB

    Score
    10/10
    isrstealerdiscoverypersistencestealertrojan

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks