Overview

overview

10

Static

static

shipment d...df.exe

windows7_x64

10

shipment d...df.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    shipment document pdf.exe

  • Size

    825KB

  • Sample

    201109-5dws2ezy3a

  • MD5

    58d90785308067dbb5b317014a3d3b41

  • SHA1

    11ce185684c80f65946c9f36029725fa48b56058

  • SHA256

    96fddf8ed5ba87a03b03c5e0387ab1f3ef44df00ce11d0761a108d6407472c86

  • SHA512

    cf1662deb92f5e6cbd87ba395931eab5c9d12ba2bda0a6ce3564dec5c63307a22bfbdbf689b8b8562d05381e7f9bfa865141bc98a87f99885d3731ab33ff87bd

Score
10/10
massloggercoreentityrezer0spywarestealer

Malware Config

Targets

    • Target

      shipment document pdf.exe

    • Size

      825KB

    • MD5

      58d90785308067dbb5b317014a3d3b41

    • SHA1

      11ce185684c80f65946c9f36029725fa48b56058

    • SHA256

      96fddf8ed5ba87a03b03c5e0387ab1f3ef44df00ce11d0761a108d6407472c86

    • SHA512

      cf1662deb92f5e6cbd87ba395931eab5c9d12ba2bda0a6ce3564dec5c63307a22bfbdbf689b8b8562d05381e7f9bfa865141bc98a87f99885d3731ab33ff87bd

    Score
    10/10
    coreentityrezer0massloggerspywarestealer

    • CoreEntity .NET Packer

      A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

      coreentity

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main Payload

    • rezer0

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks