Overview

overview

10

Static

static

Purchase Enquiry.exe

windows7_x64

10

Purchase Enquiry.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fa38f0ccd9bf16fc4a604e08edde30af5f42fe80e58c50a512351c8f786a7c12

  • Size

    782KB

  • Sample

    220420-ksrmdsdga6

  • MD5

    f05c15b7ab2caad954abd676972a2a60

  • SHA1

    f11d6be556a22800fb33908966d7b6d3a4f667a5

  • SHA256

    fa38f0ccd9bf16fc4a604e08edde30af5f42fe80e58c50a512351c8f786a7c12

  • SHA512

    df6e599ee40dab44e432ffa753de12385017a8fc80ed453466fee9ddecf77b630bffee461442cfa7a38361a19a09caed4eab0dbdfe2772e3a31d7e2be725b4cc

Score
10/10
massloggercollectionspywarestealer

Malware Config

Targets

    • Target

      Purchase Enquiry.exe

    • Size

      861KB

    • MD5

      a2d838c6e251e6090ed3c6a3920f5f1c

    • SHA1

      dd72443878e710ca004b7f9e69f6c35be633d48f

    • SHA256

      0d882f1f12ca2d8198129db908eb0cef60a375ab3796950751fc2111a60f49a8

    • SHA512

      8abd27283e8b05fb4a66c6769c18c5910dac9c3a37d002b38be55232312451c20d94408899aa17639b7a89120ccacf7a19555d1ebc149abbc0cddf35c090054d

    Score
    10/10
    massloggercollectionspywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks