isrstealer | 6297c416960bf4cba1132068c6db37874c3fec70e641b3200ab9c84b56d4b196

General

Target

35a17271da1a5f66444b085d959e0c9b_JaffaCakes118
Size

1.1MB
Sample

241011-tfrajawanj
MD5

35a17271da1a5f66444b085d959e0c9b
SHA1

ea76bfbc822f55ec1a1d3fe344d8abcc0e677553
SHA256

6297c416960bf4cba1132068c6db37874c3fec70e641b3200ab9c84b56d4b196
SHA512

96ab18423db1d9b9c689f4801d6e6bd51caa2c0b0258272bcc24bca4cfbe510a84249a025c5c53547b00947916b0c7b364163f87e0f1e9ff70601987fd9adb8f
SSDEEP

24576:yNV/yP0x2lw0AzLNH2smWuaG7c1W1UiNJGnf:GyP04wNtmWu1kW1

Score

10^/10

Malware Config

Targets

- Target
  
  35a17271da1a5f66444b085d959e0c9b_JaffaCakes118
- Size
  
  1.1MB
- MD5
  
  35a17271da1a5f66444b085d959e0c9b
- SHA1
  
  ea76bfbc822f55ec1a1d3fe344d8abcc0e677553
- SHA256
  
  6297c416960bf4cba1132068c6db37874c3fec70e641b3200ab9c84b56d4b196
- SHA512
  
  96ab18423db1d9b9c689f4801d6e6bd51caa2c0b0258272bcc24bca4cfbe510a84249a025c5c53547b00947916b0c7b364163f87e0f1e9ff70601987fd9adb8f
- SSDEEP
  
  24576:yNV/yP0x2lw0AzLNH2smWuaG7c1W1UiNJGnf:GyP04wNtmWu1kW1
Score

10^/10

isrstealer collection discovery stealer trojan upx
- ISR Stealer
  ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
  trojan stealer isrstealer
- ISR Stealer payload
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

ISR Stealer

ISR Stealer payload

Detected Nirsoft tools

NirSoft MailPassView

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2