Extracted

• • Target

    MA20-002423 WinterTrade Zrt Szeged Hungary.exe

  • Size

    995KB

  • MD5

    821b0e70a2b51999a55f15a38e6d8ca4

  • SHA1

    698488b54881ced2cebea6d0c8b57060bd232ab4

  • SHA256

    d17e7aae62fd256c264b2602f913c5b918501a1416abb5c58a4f14bcafa2b0d6

  • SHA512

    a2d9664daa16d67b4c62ec77d116037da9f93fa302e60a39836bf27da0d1beee2ebde30b6e4e6f36341e6573fe41caab0babe2e55a9b0565e5c20334244cbbfd

  Score

  10^/10

  massloggercollectioncoreentityrezer0spywarestealer

  • CoreEntity .NET Packer

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

    coreentity

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger log file

    Detects a log file produced by MassLogger.

  • ReZer0 packer

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2