Overview

overview

10

Static

static

Payment Ad...py.exe

windows7_x64

10

Payment Ad...py.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    139685166623757886e856232304c42d1f28af11b43498ffbd4c43f45da4fcc6

  • Size

    1.6MB

  • Sample

    220521-b2kqrsfhfl

  • MD5

    66ad80f8660d2ca9716a3cdc8f53d1d5

  • SHA1

    832fc0de2583a6584c64136df504d33ec850e78a

  • SHA256

    139685166623757886e856232304c42d1f28af11b43498ffbd4c43f45da4fcc6

  • SHA512

    e33b9b2b901dd21f24b91281793266845346cc4011f46493931842326349fc012f0d77a577cd6dffb6ea486fd654e6736be4bf31fc3adb77c5b4f0f12aec1e70

Score
10/10
massloggercollectioncoreentityrezer0spywarestealerupx

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    fehmi.hepsenkal@akroqack.com
  • Password:
    goodpayment12345

Targets

    • Target

      Payment Advice Copy.exe

    • Size

      1.7MB

    • MD5

      42133af0845add0288dfa643f83e4097

    • SHA1

      a2879c30d6ec2ba9531018e4ed61a411aba66857

    • SHA256

      7e26ace88d11ff4270b4dfcd7329e5ebd1000acbe4de1a5de1ae4c023de66c90

    • SHA512

      5856fe8bcb87bb042fd15be1cd584f543c6252811ec38fb97de18b5556e51d808c4a8950b46a1b8e511d02ddd3532b54a81efb466afb349f8fe8be3cf0cae091

    Score
    10/10
    massloggercollectioncoreentityrezer0spywarestealerupx

    • CoreEntity .NET Packer

      A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

      coreentity

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger log file

      Detects a log file produced by MassLogger.

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks