Overview

overview

10

Static

static

PO 450400- 13720.exe

windows7_x64

9

PO 450400- 13720.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5845ce79fcd1bbe6ed76bbff18e2f3bb98a7bd82011cf960d5cc21b69651e582

  • Size

    1.7MB

  • Sample

    220521-nsejlshbfk

  • MD5

    a082ef30e920a9de1f38b462a77125b1

  • SHA1

    a5f658477c52b7dd849e4b3435b4080660db87af

  • SHA256

    5845ce79fcd1bbe6ed76bbff18e2f3bb98a7bd82011cf960d5cc21b69651e582

  • SHA512

    75edc0e1f2c6cd223037a31e8cde40cbdab2adf59889d8beec71ef6bd4ad1124f8f8c28ba3bae1cfe378c3ca0d37788f4837f7bdd7b01f84f1a850551774f36c

Score
10/10
massloggercollectionrezer0spywarestealerupx

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.privateemail.com
  • Port:
    587
  • Username:
    eurotoolz@returntolz.com
  • Password:
    Protected@123

Targets

    • Target

      PO 450400- 13720.pif

    • Size

      1.8MB

    • MD5

      5a6d7f9876c36b2270fe5e99b096f1a4

    • SHA1

      2f458c4ed1d1edf2697bf7be60dc71a8ced883e9

    • SHA256

      e0cea593cef95fc3438ec707ef6d293c3189c3a3144a389f790cccfaec770759

    • SHA512

      a683f3ba4d84d129ffc71a8a6b7136328d15c859a943b57ecec9ce21aff998f68475b5c020bdedc82c488b57861345e703f0bb4ce6bde5cf23de805716ae610d

    Score
    10/10
    rezer0massloggercollectionspywarestealerupx

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger log file

      Detects a log file produced by MassLogger.

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks