isrstealer | 4abc945b21b66014655876d38f943cedf264760378baca3cb8c5953578401438

General

Target

JaffaCakes118_77fe484c6fe1662924343098eebca2c2
Size

602KB
Sample

250315-1ejydstxf1
MD5

77fe484c6fe1662924343098eebca2c2
SHA1

2297f067be6dee591fc2c8806a7230220328b79a
SHA256

4abc945b21b66014655876d38f943cedf264760378baca3cb8c5953578401438
SHA512

c845379f8a17a3626133114d3829b563bc53a06ed91c7a4dc489ff0a339df832e0717d25550f1fa026af2c1e6dcfcc033540ff2d5f39612109450fc3b2427fb5
SSDEEP

12288:c8qBf7bX+2+brqKG7ni9bgkWVkR69uGn0Adhd4bsUHXIRG:c8qNPX+2c4iho3umDDUY

Score

10^/10

Malware Config

Targets

- Target
  
  JaffaCakes118_77fe484c6fe1662924343098eebca2c2
- Size
  
  602KB
- MD5
  
  77fe484c6fe1662924343098eebca2c2
- SHA1
  
  2297f067be6dee591fc2c8806a7230220328b79a
- SHA256
  
  4abc945b21b66014655876d38f943cedf264760378baca3cb8c5953578401438
- SHA512
  
  c845379f8a17a3626133114d3829b563bc53a06ed91c7a4dc489ff0a339df832e0717d25550f1fa026af2c1e6dcfcc033540ff2d5f39612109450fc3b2427fb5
- SSDEEP
  
  12288:c8qBf7bX+2+brqKG7ni9bgkWVkR69uGn0Adhd4bsUHXIRG:c8qNPX+2c4iho3umDDUY
Score

10^/10

isrstealer collection discovery stealer trojan upx
- ISR Stealer
  ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
  trojan stealer isrstealer
- ISR Stealer payload
- Isrstealer family
  isrstealer
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Accesses Microsoft Outlook accounts
  collection
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

ISR Stealer

ISR Stealer payload

Isrstealer family

Detected Nirsoft tools

NirSoft MailPassView

NirSoft WebBrowserPassView

Accesses Microsoft Outlook accounts

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2