MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 9fdaeab4153639b870fcb0522b1e0801aceb515e51b20603a1413086a82825bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
ISRStealer
Vendor detections: 8
| SHA256 hash: | 9fdaeab4153639b870fcb0522b1e0801aceb515e51b20603a1413086a82825bf |
|---|---|
| SHA3-384 hash: | ea9d5c2b2732023c612ea4898ef5ca6213438bdf16a124b279a670a82b983b005ccb89e1942548f49e18c8acef40a9b0 |
| SHA1 hash: | 3635be9ca0d1efc9888754df6c651d1fc286c61e |
| MD5 hash: | 2e71acfd7bc1c286d8f4ffa440e1b986 |
| humanhash: | river-gee-pennsylvania-four |
| File name: | IENmail#swift-mt103.66090437.exe |
| Download: | download sample |
| Signature | ISRStealer |
| File size: | 995'840 bytes |
| First seen: | 2020-11-06 17:34:51 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 6cea15fcbfd6616496bbe80d9d9d0796 (26 x Loki, 25 x AgentTesla, 10 x ISRStealer) |
| ssdeep | 24576:iVMHwG0ON514iuyWEpajSN8ONpZ2Je9sKZ7w4:iVtGXrGi/hpajSN8ONpZtsKZ7w4 |
| Threatray | 419 similar samples on MalwareBazaar |
| TLSH | 3425AF23ADA18837C12336399C1B5B649F26BF312925B9862BFD3D0F5F397417825293 |
| Reporter |  abuse_ch |
| Tags: | exe ISRStealer |
abuse_ch
Malspam distributing unidentified malware:HELO: jktd3khmail02v.cloudkilat.me
Sending IP: 103.43.47.239
From: Accounts <contact@tarex.pro>
Subject: FW: payment copy for bill no. 1895, 1896,1960,1967,1966 No. 541736 Dt. 28.09.20 for Euro. 17901.82/-
Attachment: IENmailswift-mt103.66090437.bit.zip (contains "IENmail#swift-mt103.66090437.exe")
Intelligence
File Origin
# of uploads :
1
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Unauthorized injection to a recently created process
Reading critical registry keys
Creating a file in the %temp% directory
DNS request
Connection attempt
Deleting a recently created file
Searching for the window
Stealing user critical data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
ISRStealer MailPassView
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Signature
Contains functionality to detect sleep reduction / modifications
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Passes username and password via HTTP get
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Yara detected ISRStealer
Yara detected MailPassView
Behaviour
Behavior Graph:
Threat name:
Win32.Infostealer.Fareit
Status:
Malicious
First seen:
2020-11-06 17:41:18 UTC
AV detection:
25 of 28 (89.29%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 409 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
8/10
Tags:
spyware upx
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
UPX packed file
Unpacked files
SH256 hash:
9fdaeab4153639b870fcb0522b1e0801aceb515e51b20603a1413086a82825bf
MD5 hash:
2e71acfd7bc1c286d8f4ffa440e1b986
SHA1 hash:
3635be9ca0d1efc9888754df6c651d1fc286c61e
SH256 hash:
81014e51c7bb43c57db0f7278089d040524295dc78c2b0ca6ac4a65faa79cac8
MD5 hash:
85145c4cb14a82774c53fe1842371e62
SHA1 hash:
99f80ee837e8ed8958d9bb8702144a5f4023ef48
Detections:
win_isr_stealer_a0
win_isr_stealer_auto
SH256 hash:
715472bbb65283ee8269de8b2d5f3c3284e52b5bd8022d59b87111db51be4d61
MD5 hash:
e78ad5a835a4423ddb8a1944204f21f5
SHA1 hash:
9f20909a5c25f4358e82180f3345ad974e983097
SH256 hash:
34e4a870213f0a360565cc7f22aa88f39068ff2ff1e5089e4ff571166eda90c9
MD5 hash:
0208c859f6da9e03bc54df7f006aa7e6
SHA1 hash:
3e98ce9290a931ab5fa015a92e5447152cf62920
SH256 hash:
68d2b3836067785a5cd49d5865600be455910d785d5804bd95712ad45ca570bd
MD5 hash:
5c2e3e961e093aee9a10910a9319a779
SHA1 hash:
7fd994ac92f1b9ef5179446539087bed0c266380
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.