Extracted

• • Target

    mpUN2haQz3Hh396.exe

  • Size

    872KB

  • MD5

    b616ebc834b650fee67ce3e99095dc6f

  • SHA1

    c59a55cfb577b14589024ac0a34edcdb39d02c74

  • SHA256

    f058f245d06f4d059132d2b9e90f84a332d0471ff0c421d49ca828d76874b8f3

  • SHA512

    9b971064e009f3c52da0998fc31956bd3b156bb0a69447a1ef4960e54b4b145d8104b88b18b8a72a65b66cbd59445ec9210439e9b41a25b9cd919d15b9c11ee7

  Score

  10^/10

  massloggercollectioncoreentityevasionrezer0spywarestealer

  • CoreEntity .NET Packer

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

    coreentity

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger log file

    Detects a log file produced by MassLogger.

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • ReZer0 packer

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2