Extracted

• • Target
    PROJECT-0039382.exe
  • Size 363KB
  • SHA256 1136fada0e7737d8ea5304cb8e85550cf1ca35e2b64bfa6e000b07d5c428f7d7
  • MD5 9472287f8d3ce5d09ed8adf54230b98e
  • SHA1 c02248caa827d496219fb9a096a612cb9e5ac41d
  • SHA512 f6089d34f47b398f615cdedd1dc07125ca07e720a2bc4c9ec4fdfdbb48c267688479592891907be4115a8f0f6343c7a04f90045e3f9085ec2563ed4ea59b1641
  • MD5 SHA1 SHA512

  Score

  10^/10

  m00nd3v_loggercoreentityrezer0spywarestealer

  • CoreEntity .NET Packer

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

    coreentity

  • M00nd3v_Logger

    M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

    stealerspywarem00nd3v_logger

  • M00nD3v Logger Payload

    Detects M00nD3v Logger payload in memory.

  • rezer0

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Uses the VBS compiler for execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2