Extracted

• • Target

    DHL Document.exe

  • Size

    877KB

  • MD5

    8667413de7acc939e5157862390e49ca

  • SHA1

    e09365296e8bcb1d1842032d3e31d2b6e880a75e

  • SHA256

    d2aba15a355f2587296a0d3de5416fe3ad7a644aaf39e9b8c5be0125a346abc6

  • SHA512

    0e64a10bd8925cc5f4be46c2d9ee4f0d5dac8e482ff86b5658d198ed7b30732e138e2b48e5a136d6269b8ee4c357e6454b31d184402c0477ac2985180c02ba3a

  Score

  10^/10

  massloggercollectioncoreentityrezer0spywarestealer

  • CoreEntity .NET Packer

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

    coreentity

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger log file

    Detects a log file produced by MassLogger.

  • ReZer0 packer

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2