Overview

overview

10

Static

static

3

LYUoz7EXa2f53y3.exe

windows7-x64

10

LYUoz7EXa2f53y3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    50098adfb092935ab8d9b30fc0bf69d1_JaffaCakes118

  • Size

    812KB

  • Sample

    240517-r2we9scd73

  • MD5

    50098adfb092935ab8d9b30fc0bf69d1

  • SHA1

    7bfb6d08ff25cb0911ae0483be018b68fd2312b4

  • SHA256

    92ada9f6219ca67d776271d49eeda8fc231b0d9a98b46686d5318261fd116d15

  • SHA512

    73864d958867795226d42802e4c5e9dee0a64da4bba5e64684c627b4b511e35ffa98e3196986e042faa1a042695e4cc2777eb94d0c1bc79b9ffc03b2bd420700

  • SSDEEP

    24576:+ynEf+ne66xwhj+7Nx334UvJE9loRl1syAnCvIRHQ:+ynEf+e66xEjkN14eC9NnmiHQ

Score
10/10
massloggercollectionrezer0spywarestealer

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.mytravelexplorer.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    43K+H2..0_g^

Targets

    • Target

      LYUoz7EXa2f53y3.exe

    • Size

      864KB

    • MD5

      1274d72e82a4a389f9bd063c4b025bc0

    • SHA1

      42bcb1cbe89361be9d538dffd2b71429ad7070cf

    • SHA256

      641fe8dbcfc7cf68d594eda921ce75269e4d3bb74a02b7116facb091020f0806

    • SHA512

      9699256cd3b4bea5a0230536639a00ae3ee41b6ff3cea851a31bf49d3a33af30a85a21921edd58321d85d3f19fce2b6a9eb95e2231f24da5b0df2e2d4d6ee0cc

    • SSDEEP

      24576:plv9Wc7NBpneCf6vw3j+7Tx3B4mNJA9fyRvZsAALCvoR:plv9Wc7/peCf6vkjkTn4ky9VLmC

    Score
    10/10
    massloggercollectionrezer0spywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main payload

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks