Overview

overview

10

Static

static

NEW ORDER-pdf.exe

windows7_x64

10

NEW ORDER-pdf.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c97a85b9365892a80cc4aa90617e23a9b4c9f60006cb3f6fa50e8b0608313cb8

  • Size

    916KB

  • Sample

    220502-svdgjsaeen

  • MD5

    09851d4ddfc3a49266f7258cd6808ce2

  • SHA1

    261cdebfe27f1b57201fafc19d2b98728948dafb

  • SHA256

    c97a85b9365892a80cc4aa90617e23a9b4c9f60006cb3f6fa50e8b0608313cb8

  • SHA512

    8e3853351b635a7797eb15b0600834d49987c96e02c89bea17de7569b757c96fce31d416803411b36872d5e6b9a58d48b1e5e748ce7f9cdbedd1443236336c30

Score
10/10
massloggercollectionspywarestealer

Malware Config

Targets

    • Target

      NEW ORDER-pdf.exe

    • Size

      975KB

    • MD5

      8d656218e53f2ad9c26305b758ba9aeb

    • SHA1

      2d313b132c0cc280739a3dc9034c6d8891284f77

    • SHA256

      779ef456127a144ebaa7485d4109add0574ec267fc350d4d3493d77631a56fde

    • SHA512

      7d25a693230bc6a902ee81c084d0f7f894240bc674a870ce611e5d59bee6af62de4a5023ccb461caba8d7db4b82d37aad0de6c1bb1edc39b94a5752144375de2

    Score
    10/10
    massloggercollectionspywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks