General
- Target jaffacakes118_Weather.Wars.3D.German.2011.DL.720p.BluRay.x264-AMBASSADOR.exe
- Size 1.2MB
- Sample260910-cyfhbawwfz
- SHA256 0d0fd12c5521e43605d4fc382ba44725b35012976dfb9a03d5199d0c33f9b153
Score
10/10
Malware Config
Targets
-
- Target jaffacakes118_Weather.Wars.3D.German.2011.DL.720p.BluRay.x264-AMBASSADOR.exe
- Size 1.2MB
- SHA256 0d0fd12c5521e43605d4fc382ba44725b35012976dfb9a03d5199d0c33f9b153
Score10/10-
Family: ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts
-
Suspicious use of SetThreadContext
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.