Overview

overview

10

Static

static

Halkbank_E...df.exe

windows7_x64

1

Halkbank_E...df.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    82988b0e4f396aad7ebbd2f4db7f76680115df3464c770b3bb394fb09204782b

  • Size

    1.2MB

  • Sample

    220417-jppsyseda3

  • MD5

    09f3b7f7454e8ba0f1066aa706b3ef12

  • SHA1

    56874dcaf123a11b421ba483105e9e4d44de008c

  • SHA256

    82988b0e4f396aad7ebbd2f4db7f76680115df3464c770b3bb394fb09204782b

  • SHA512

    e88d8302e96bf2f8bbad214a96b06b759cc9e9cf1b1cbdb84871b3aabc7d035cc74038d93b262425ea3bd75277409f26ff29beba4614fc3c1e2b1832f030b7fa

Score
10/10
massloggercollectionspywarestealer

Malware Config

Targets

    • Target

      Halkbank_Ekstre_20201019_080416_900140.pdf.exe

    • Size

      2.0MB

    • MD5

      78232de6e3d5cde5080f46df6216bc3a

    • SHA1

      3c72ec5a1e21349ff72f75189cb781444744132b

    • SHA256

      fdfa7f1312d60c75bcd775c87616b731602bbd1c658bbe63d6069f4243c85553

    • SHA512

      db1f60bd7fdf498ba8a7f1b76e2e7196c8c5745e34e8202aeb92a74f9125e30ad216880993836ec0d42daebcf9dc3beee2a96e80b171b0523d6b15d0b2f97730

    Score
    10/10
    massloggercollectionspywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks