Extracted

• • Target

    Payment Advice Copy.exe

  • Size

    1.7MB

  • MD5

    42133af0845add0288dfa643f83e4097

  • SHA1

    a2879c30d6ec2ba9531018e4ed61a411aba66857

  • SHA256

    7e26ace88d11ff4270b4dfcd7329e5ebd1000acbe4de1a5de1ae4c023de66c90

  • SHA512

    5856fe8bcb87bb042fd15be1cd584f543c6252811ec38fb97de18b5556e51d808c4a8950b46a1b8e511d02ddd3532b54a81efb466afb349f8fe8be3cf0cae091

  Score

  10^/10

  massloggercollectioncoreentityrezer0spywarestealerupx

  • CoreEntity .NET Packer

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

    coreentity

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger log file

    Detects a log file produced by MassLogger.

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • ReZer0 packer

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2