Overview

overview

10

Static

static

PREVENTIVO 56768.exe

windows7_x64

10

PREVENTIVO 56768.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PREVENTIVO 56768.exe

  • Size

    2.1MB

  • Sample

    201109-s1h8l99lmn

  • MD5

    fe5fef01ed18bdd75d39893c73326317

  • SHA1

    448fcedd08737c03a3f2944cb0738e84aab5d3e9

  • SHA256

    8978b5eb14061436a8d2249f9c92ac75d8307c83a09ea7aa3e6572f704b4335f

  • SHA512

    d05cdc257bdb4ab1f4695463b92686f2c191a68ed22ce99b2db75c4ff5f46f7c41972e1ce3aa010525791633f0fa4ac5388a4d3fce4414efc0e5660f4f35e01e

Score
10/10
massloggercoreentityrezer0spywarestealerupx

Malware Config

Targets

    • Target

      PREVENTIVO 56768.exe

    • Size

      2.1MB

    • MD5

      fe5fef01ed18bdd75d39893c73326317

    • SHA1

      448fcedd08737c03a3f2944cb0738e84aab5d3e9

    • SHA256

      8978b5eb14061436a8d2249f9c92ac75d8307c83a09ea7aa3e6572f704b4335f

    • SHA512

      d05cdc257bdb4ab1f4695463b92686f2c191a68ed22ce99b2db75c4ff5f46f7c41972e1ce3aa010525791633f0fa4ac5388a4d3fce4414efc0e5660f4f35e01e

    Score
    10/10
    massloggercoreentityrezer0spywarestealerupx

    • CoreEntity .NET Packer

      A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

      coreentity

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger log file

      Detects a log file produced by MassLogger.

    • rezer0

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks