Overview

overview

10

Static

static

3

eba1b6a9c7...9N.exe

windows7-x64

10

eba1b6a9c7...9N.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eba1b6a9c7e7bff2c7e1eee915d04e1123190e2186ae51eef744ad18901a4d79N.exe

  • Size

    492KB

  • Sample

    241205-bssp1sxjbq

  • MD5

    b73b615100f8b5ab85df87f9ca529960

  • SHA1

    470a305dc5802e04ca80d00dcb1c7292e185aaea

  • SHA256

    eba1b6a9c7e7bff2c7e1eee915d04e1123190e2186ae51eef744ad18901a4d79

  • SHA512

    fd87462bfad756f1b9c4dd19fc28ddf8d592fc5c4f162a7479ae1e379f78a4db1e9ce9b8b0010de24979134c9ccf704e3e671072734b1dea3e99121562f9462c

  • SSDEEP

    12288:/knms/dM9gz8NRRIaV3GhQxHNcmdqG8Doj64:/knm2wZxgQxHqm8Ggoj64

Score
10/10
isrstealercollectiondiscoveryspywarestealertrojanupx

Malware Config

Targets

    • Target

      eba1b6a9c7e7bff2c7e1eee915d04e1123190e2186ae51eef744ad18901a4d79N.exe

    • Size

      492KB

    • MD5

      b73b615100f8b5ab85df87f9ca529960

    • SHA1

      470a305dc5802e04ca80d00dcb1c7292e185aaea

    • SHA256

      eba1b6a9c7e7bff2c7e1eee915d04e1123190e2186ae51eef744ad18901a4d79

    • SHA512

      fd87462bfad756f1b9c4dd19fc28ddf8d592fc5c4f162a7479ae1e379f78a4db1e9ce9b8b0010de24979134c9ccf704e3e671072734b1dea3e99121562f9462c

    • SSDEEP

      12288:/knms/dM9gz8NRRIaV3GhQxHNcmdqG8Doj64:/knm2wZxgQxHqm8Ggoj64

    Score
    10/10
    isrstealercollectiondiscoveryspywarestealertrojanupx

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Isrstealer family

      isrstealer

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks