MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 a742c060fde260f8c469d5dea7354bc08eeb6b7811305fd833268d2012dd9540. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
ISRStealer
Vendor detections: 6
| SHA256 hash: | a742c060fde260f8c469d5dea7354bc08eeb6b7811305fd833268d2012dd9540 |
|---|---|
| SHA3-384 hash: | 01000040be2a7d6224e6f59d759c7ba20097b95eca12cd42c994f90a1537625ba3ebe1d55996ffc09e93dbce5a218c1f |
| SHA1 hash: | 036be253aa400e01a3742d963e1bf86601f65e39 |
| MD5 hash: | 038636b2c1067b5c7a0901f3a3526467 |
| humanhash: | seven-salami-spaghetti-ohio |
| File name: | 164cfe6eada25d9bceb6af0d2863765d |
| Download: | download sample |
| Signature | ISRStealer |
| File size: | 1'236'954 bytes |
| First seen: | 2020-11-17 11:25:11 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 3eaa732d4dae53340f9646bdd85dac41 (11 x NetSupport, 6 x RedLineStealer, 4 x ISRStealer) |
| ssdeep | 24576:EpZ/8p85tzMbWNlGfZ63RFov4cKs8ipYwQ5DsQgektWydh:e8p85lMbTZ6hF84RapYwQeukF |
| Threatray | 616 similar samples on MalwareBazaar |
| TLSH | 1045CF042B58C572C20CCD3FCDB992F1AD613C50D74DC557A7BA3E3634339AAAA31AA5 |
| Reporter |  seifreed |
| Tags: | ISRStealer |
Intelligence
File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Creating a file
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
Deleting a recently created file
Launching a process
Reading critical registry keys
Creating a file in the %temp% directory
DNS request
Sending an HTTP GET request
Sending a custom TCP request
BSOD occurred
Searching for the window
Setting a single autorun event
Stealing user critical data
Enabling autorun by creating a file
Unauthorized injection to a system process
Result
Verdict:
0
Threat name:
Win32.Trojan.Blueso
Status:
Malicious
First seen:
2020-11-17 11:26:13 UTC
AV detection:
22 of 28 (78.57%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 606 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
8/10
Tags:
evasion persistence spyware trojan upx
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Modifies registry class
Program crash
Suspicious use of SetThreadContext
Adds Run key to start application
Checks whether UAC is enabled
Loads dropped DLL
Reads user/profile data of web browsers
Checks computer location settings
Executes dropped EXE
UPX packed file
Unpacked files
SH256 hash:
a742c060fde260f8c469d5dea7354bc08eeb6b7811305fd833268d2012dd9540
MD5 hash:
038636b2c1067b5c7a0901f3a3526467
SHA1 hash:
036be253aa400e01a3742d963e1bf86601f65e39
SH256 hash:
8a22987d4558365f70f38039b1591c44e73d53a249bfb340277e19635f95785a
MD5 hash:
3021ec1412e5b0d114df6be08b0a49c6
SHA1 hash:
858270554b640e0bb9dcc0b3e1abcce5472d8c2d
SH256 hash:
fa27b2b0b7b963db61725856aec82329f11af8a61ce25f94c2390440e1047755
MD5 hash:
61831b60155363591d2e71785e2a2e11
SHA1 hash:
cb3d2e29a8330e4926458acf65e2212efd027f9c
Detections:
win_isr_stealer_a0
win_isr_stealer_auto
SH256 hash:
715472bbb65283ee8269de8b2d5f3c3284e52b5bd8022d59b87111db51be4d61
MD5 hash:
e78ad5a835a4423ddb8a1944204f21f5
SHA1 hash:
9f20909a5c25f4358e82180f3345ad974e983097
SH256 hash:
34e4a870213f0a360565cc7f22aa88f39068ff2ff1e5089e4ff571166eda90c9
MD5 hash:
0208c859f6da9e03bc54df7f006aa7e6
SHA1 hash:
3e98ce9290a931ab5fa015a92e5447152cf62920
SH256 hash:
68d2b3836067785a5cd49d5865600be455910d785d5804bd95712ad45ca570bd
MD5 hash:
5c2e3e961e093aee9a10910a9319a779
SHA1 hash:
7fd994ac92f1b9ef5179446539087bed0c266380
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Delivery method
Other
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.