Extracted

• • Target

    x2KDOSVNRiSbYcK.exe

  • Size

    871KB

  • MD5

    23623b167a6e271b89f266cda6f4d308

  • SHA1

    b8f5846cf059451256cf6d25f804588651a4b04b

  • SHA256

    8a3dd3eb355760a77c7bd89e2316c7741e37f9b20435a23d144e58ba856bd7c7

  • SHA512

    11830c8366ec005b3439c9b9bf4de62db61d44d0c296b9d91a2c3705fa2f3454abd84bc1a711f55db2926c89f6556c3751e4af292e4cfe0456038886552fe760

  Score

  10^/10

  massloggercollectioncoreentityrezer0spywarestealer

  • CoreEntity .NET Packer

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

    coreentity

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger log file

    Detects a log file produced by MassLogger.

  • ReZer0 packer

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2