Overview

overview

10

Static

static

3

088b9daa3a...c8.exe

windows7-x64

10

088b9daa3a...c8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    088b9daa3a7cdfa8d63b495246f8f9ae9b2912e85aef8c9077f3ed5afe13b0c8.exe

  • Size

    389KB

  • Sample

    250107-zqnv2syjcs

  • MD5

    a62215571b14a4b8fe05d534088c36a6

  • SHA1

    b412a34ec2d953f5a0ea2f795e31f5b0dea15577

  • SHA256

    088b9daa3a7cdfa8d63b495246f8f9ae9b2912e85aef8c9077f3ed5afe13b0c8

  • SHA512

    2061dfc62657c93133392873418944f8a94a0d2f51eae17e52fd034e938543e4ae858a4fcfa8e038a95f2a6cbeef30b4ed725fe60343bd4e2eb5369d4e130b0d

  • SSDEEP

    6144:JtEVpyJD+zjjSKDCmSam8xOPC4sOwMrSWtDYR3x0/9Yz1is:JtEVpyJyzjjJ4aBmCQr50uFK

Score
10/10
isrstealercollectiondiscoveryspywarestealertrojanupx

Malware Config

Targets

    • Target

      088b9daa3a7cdfa8d63b495246f8f9ae9b2912e85aef8c9077f3ed5afe13b0c8.exe

    • Size

      389KB

    • MD5

      a62215571b14a4b8fe05d534088c36a6

    • SHA1

      b412a34ec2d953f5a0ea2f795e31f5b0dea15577

    • SHA256

      088b9daa3a7cdfa8d63b495246f8f9ae9b2912e85aef8c9077f3ed5afe13b0c8

    • SHA512

      2061dfc62657c93133392873418944f8a94a0d2f51eae17e52fd034e938543e4ae858a4fcfa8e038a95f2a6cbeef30b4ed725fe60343bd4e2eb5369d4e130b0d

    • SSDEEP

      6144:JtEVpyJD+zjjSKDCmSam8xOPC4sOwMrSWtDYR3x0/9Yz1is:JtEVpyJyzjjJ4aBmCQr50uFK

    Score
    10/10
    isrstealercollectiondiscoveryspywarestealertrojanupx

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Isrstealer family

      isrstealer

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks