isrstealer | 7606d0813a456f9f7599614e892ebd824ea29dda6b1d49c3d28210a79c253e01

General

Target

7606d0813a456f9f7599614e892ebd824ea29dda6b1d49c3d28210a79c253e01.exe
Size

962KB
Sample

250202-mgmkeazjdq
MD5

05fef27b342e781baf4afb4a5b62cac3
SHA1

538f859e713439d99efb1491bfbe2c99005e209f
SHA256

7606d0813a456f9f7599614e892ebd824ea29dda6b1d49c3d28210a79c253e01
SHA512

b58d6351a7503b330d9cc96926f9e05514f6106fc560cfc89d3ce04cbfa8885394c296798485630b2b61d96c72f2aa3230838e63b33d2b9481876f6267d16435
SSDEEP

24576:Jt24wfvf7a8DPw67oc1xuzoVF5r5QAwFv0XcI:1ef7aD6Ffuw7B2fI

Score

10^/10

Malware Config

Targets

- Target
  
  7606d0813a456f9f7599614e892ebd824ea29dda6b1d49c3d28210a79c253e01.exe
- Size
  
  962KB
- MD5
  
  05fef27b342e781baf4afb4a5b62cac3
- SHA1
  
  538f859e713439d99efb1491bfbe2c99005e209f
- SHA256
  
  7606d0813a456f9f7599614e892ebd824ea29dda6b1d49c3d28210a79c253e01
- SHA512
  
  b58d6351a7503b330d9cc96926f9e05514f6106fc560cfc89d3ce04cbfa8885394c296798485630b2b61d96c72f2aa3230838e63b33d2b9481876f6267d16435
- SSDEEP
  
  24576:Jt24wfvf7a8DPw67oc1xuzoVF5r5QAwFv0XcI:1ef7aD6Ffuw7B2fI
Score

10^/10

isrstealer collection defense_evasion discovery persistence stealer trojan upx
- ISR Stealer
  ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
  trojan stealer isrstealer
- ISR Stealer payload
- Isrstealer family
  isrstealer
- Modifies visiblity of hidden/system files in Explorer
  defense_evasion
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2