Overview

overview

10

Static

static

RFQ For P....df.exe

windows7_x64

10

RFQ For P....df.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b163004e067a5fb9aece369e536cee93dfb0dcd72c3fdd641b1fdacdd1d6b914

  • Size

    1.7MB

  • Sample

    220521-crnv4shdeq

  • MD5

    9044b3b2ea6e1da700d7e931dd61f1e1

  • SHA1

    2b63dd1fe5dac6fba0bbb4f553d504bbd7de7800

  • SHA256

    b163004e067a5fb9aece369e536cee93dfb0dcd72c3fdd641b1fdacdd1d6b914

  • SHA512

    4deaf4bee949fc149d52043f9bf0dee68468caf2197e7ba7b8bbe16cb9927a30a261e47be0bf0ddc993206cba0eb297dbc2d6326b586f30acee8aa8c4dd07788

Score
10/10
massloggercollectionrezer0spywarestealerupx

Malware Config

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.tashipta.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    @Success$2020

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    moneymustdrop

Targets

    • Target

      RFQ For P.T Int #40803788200019 ,pdf.exe

    • Size

      1.8MB

    • MD5

      a41fdbd40b07e4cec71b57868db22eaf

    • SHA1

      90992b92cbda0f62a6990ad47e2ceccd1c3df1dd

    • SHA256

      5136cc442f7ff2a99cb5c3c64c0419d23a3aba57f7389af3a758615eb8b6d26b

    • SHA512

      c887e6f7899d8e9128cc7bec43baa53d85636e2e4ea4f50ce9d08e001562e389c05ede96d60e92f92782c6644f0082646e14d066051ab01bf4658d817ccef3de

    Score
    10/10
    massloggercollectionrezer0spywarestealerupx

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger log file

      Detects a log file produced by MassLogger.

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks