MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 973c6ca52f1749604a7ba4aeeb65e2e3ea610707651dd637199249bf4ba0b6ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
ISRStealer
Vendor detections: 5
| SHA256 hash: | 973c6ca52f1749604a7ba4aeeb65e2e3ea610707651dd637199249bf4ba0b6ea |
|---|---|
| SHA3-384 hash: | 9565262439045cf8c39e79de67f76af53e608b785a4a823663c2a0a4652021fce6f6760247c3687f3fd8f69f4ec7e3cd |
| SHA1 hash: | 333faf67223ef23d38c2aea5c752e55f4586bfeb |
| MD5 hash: | 5d27a65d7b351dab1b3f7c8b69977c94 |
| humanhash: | kitten-purple-batman-skylark |
| File name: | gggggggg.exe |
| Download: | download sample |
| Signature | ISRStealer |
| File size: | 1'027'072 bytes |
| First seen: | 2020-06-25 09:33:44 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | a29f4efb911c4906418600fd25679688 (11 x Loki, 10 x AgentTesla, 2 x HawkEye) |
| ssdeep | 24576:v69dI9Dl7bPF4sm9dNdNByMEfAm0F4rz6W5SstZuKs:v696/ieAm0F7F |
| Threatray | 382 similar samples on MalwareBazaar |
| TLSH | 6C25AFE2F6A14437C1721A3B4C6B52F558297E10AD28A5463BE4DDCC8FFB2413835EA7 |
| Reporter |  abuse_ch |
| Tags: | exe ISRStealer |
abuse_ch
Malspam distributing ISRStealer:HELO: seguramenteatelier.pt
Sending IP: 156.96.118.33
From: Procure@seguramenteatelier.pt
Reply-To: procure11@gmail.com
Subject: Urgent Supplies Needed
Attachment: sample quotation.zip (contains "gggggggg.exe")
Intelligence
File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection:
ISRStealer
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Unauthorized injection to a recently created process
Reading critical registry keys
Creating a file in the %temp% directory
Sending an HTTP GET request
Deleting a recently created file
Searching for the window
Stealing user critical data
Gathering data
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
hawkeyekeylogger
emotet
Similar samples:
+ 372 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
8/10
Tags:
spyware
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
UPX packed file
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.