MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 09abaa1b12ae6d7ed845027756e8852a39ac0a75fecf53f76c08ce48bdf58b91. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
ISRStealer
Vendor detections: 7
| SHA256 hash: | 09abaa1b12ae6d7ed845027756e8852a39ac0a75fecf53f76c08ce48bdf58b91 |
|---|---|
| SHA3-384 hash: | 5427a6839a4597a5fb2d8f379c8c00d7d54da50a89bbd0d460667f8feb16b15f17d2fe0692a211dc9722198065bc1c0f |
| SHA1 hash: | fd00800bb7f4a0499742eb5ee71427fdef5e0592 |
| MD5 hash: | 056347ef33d8723e7fe77e03809ea6a8 |
| humanhash: | romeo-wolfram-magazine-pizza |
| File name: | IMPORT-BOOKING DETAILS.xls.bit.exe |
| Download: | download sample |
| Signature | ISRStealer |
| File size: | 964'608 bytes |
| First seen: | 2020-11-16 13:11:15 UTC |
| Last seen: | 2020-11-16 15:28:58 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | d8883a9682fec3dd3ef67131c839648f (1 x ISRStealer, 1 x Loki) |
| ssdeep | 12288:ZhBLpoSm1xKQJWXT+LBtwssiyBEevtY19+iaNLOd6YrR/YpuRwlpC7dmJVwukSeU:B5WKQJq6twVjY1EMNyu+CJhuk0pIm |
| Threatray | 476 similar samples on MalwareBazaar |
| TLSH | 9C25BF23A3B14837C5632A788C3B5BA8DD36FE1029657B576BF41D489FF92807825393 |
| Reporter |  cocaman |
| Tags: | exe ISRStealer |
Intelligence
File Origin
# of uploads :
3
# of downloads :
116
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Unauthorized injection to a recently created process
Launching a process
Sending a UDP request
Reading critical registry keys
Creating a file in the %temp% directory
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Deleting a recently created file
Searching for the window
Stealing user critical data
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Gathering data
Result
Threat name:
ISRStealer MailPassView
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
Contains functionality to detect sleep reduction / modifications
Delayed program exit found
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Drops VBS files to the startup folder
Injects a PE file into a foreign processes
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Passes username and password via HTTP get
Queues an APC in another process (thread injection)
Sigma detected: Drops script at startup location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Writes to foreign memory regions
Yara detected ISRStealer
Yara detected MailPassView
Behaviour
Behavior Graph:
Threat name:
Win32.Spyware.OutBreak
Status:
Malicious
First seen:
2020-11-16 09:31:14 UTC
File Type:
PE (Exe)
Extracted files:
47
AV detection:
28 of 29 (96.55%)
Threat level:
2/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 466 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
8/10
Tags:
spyware upx
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Drops startup file
Reads user/profile data of web browsers
UPX packed file
Unpacked files
SH256 hash:
09abaa1b12ae6d7ed845027756e8852a39ac0a75fecf53f76c08ce48bdf58b91
MD5 hash:
056347ef33d8723e7fe77e03809ea6a8
SHA1 hash:
fd00800bb7f4a0499742eb5ee71427fdef5e0592
SH256 hash:
b48c4784be1cfb35fe51292eba94fbbb5abf8aaca82f6e0d7cb308b8f8f307dd
MD5 hash:
18d876d9f7443527bb9545c52fa143d2
SHA1 hash:
da68237330b98ce5750648e51516281178fc6769
Detections:
win_isr_stealer_a0
win_isr_stealer_auto
SH256 hash:
715472bbb65283ee8269de8b2d5f3c3284e52b5bd8022d59b87111db51be4d61
MD5 hash:
e78ad5a835a4423ddb8a1944204f21f5
SHA1 hash:
9f20909a5c25f4358e82180f3345ad974e983097
SH256 hash:
34e4a870213f0a360565cc7f22aa88f39068ff2ff1e5089e4ff571166eda90c9
MD5 hash:
0208c859f6da9e03bc54df7f006aa7e6
SHA1 hash:
3e98ce9290a931ab5fa015a92e5447152cf62920
SH256 hash:
68d2b3836067785a5cd49d5865600be455910d785d5804bd95712ad45ca570bd
MD5 hash:
5c2e3e961e093aee9a10910a9319a779
SHA1 hash:
7fd994ac92f1b9ef5179446539087bed0c266380
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Other
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.