Static task
static1
Behavioral task
behavioral1
Sample
PO__2008.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PO__2008.exe
Resource
win10v2004-20220414-en
General
-
Target
d691b9659a18c0d257cf10a825f68e95efd3817177453a20ea757005d2b035c0
-
Size
1.9MB
-
MD5
9e3cbd6324436a97e1af52cc7674d63a
-
SHA1
8303bd2214edc5fc7a4df10f8789f29eedee2aa8
-
SHA256
d691b9659a18c0d257cf10a825f68e95efd3817177453a20ea757005d2b035c0
-
SHA512
370533706d48bc8d9791553196f65712c8944bb925eb47fea4703e5300c71b187495bc213362cafd8e7d685a6f568d847a6f7d1c13931a0b69f78275106153af
-
SSDEEP
12288:TWaU3A6VEt61JTU+XpkX/+sVjYVLQJvNA5jU8qgPUi5e+PaOvcgG+I:c3A6N1JTVpkbVjaEjWqgPUi5xPa
Malware Config
Signatures
-
MassLogger Main Payload 2 IoCs
Processes:
resource yara_rule sample family_masslogger static1/unpack001/PO__2008.EXE family_masslogger -
Masslogger family
Files
-
d691b9659a18c0d257cf10a825f68e95efd3817177453a20ea757005d2b035c0.iso
-
PO__2008.EXE.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 89KB - Virtual size: 89KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ