Extracted

• • Target

    Purchase order No# PO-38001830013 dt 10-05-20.exe

  • Size

    879KB

  • MD5

    14e4f7e80b29919cb9e669f2b4f92599

  • SHA1

    6bf307456d4881bd68dfd64b9a0cf20b9f0e5909

  • SHA256

    ad8cb5298f8a5a5cfdef92b5aee76f05e43d9e81fabfe79e0f880adc6690821b

  • SHA512

    d19909fb2a2135c838bc0f53d8593dc417962f84e121f79c3e44a1951046b752d3fb003f00b94a8cb794befceb181c52efff8a66259f66e3a5dde9834b65be33

  Score

  10^/10

  massloggercollectioncoreentityrezer0spywarestealer

  • CoreEntity .NET Packer

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

    coreentity

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger log file

    Detects a log file produced by MassLogger.

  • ReZer0 packer

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2