Overview

overview

10

Static

static

3

Inquiry N0...45.exe

windows7-x64

10

Inquiry N0...45.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ecb873bc78998e86bd60ebfd9ceb264d_JaffaCakes118

  • Size

    782KB

  • Sample

    240920-dkfrlawckn

  • MD5

    ecb873bc78998e86bd60ebfd9ceb264d

  • SHA1

    2af0e77e15e6a0c8c6e56c9cf552cdbaea9cbc55

  • SHA256

    384c42252da110aa2eeaf07046e0e8c43b77f4cb6aebcc0678b3cddb80e382d5

  • SHA512

    5411c74afc01a6084916c3235ea604014456ab06bc6e8f9f630d56da15c974889728a612d00e0a365691bf2bfb9db6525a858bbcd23fae7353af8efbae3a15b8

  • SSDEEP

    12288:VPxrMjtv+r5yScQyJTAelImNX1qRjhwnDC1C5WGb0xJVffdCtoAsvZhXsRQAcODi:RUt+rcS12TVlIkqjhwDqSsLXstganHtg

Score
10/10
massloggercollectioncredential_accessdiscoveryrezer0spywarestealer

Malware Config

Targets

    • Target

      Inquiry N0. 20000220345.exe

    • Size

      822KB

    • MD5

      2acdd91d79cf4d45462d8b7738f3fdcc

    • SHA1

      f292f05cbff4ab1685a7258e0b581080af45ba54

    • SHA256

      9a76fa2bd0df22fd79b7e38248b3a765a524070bc68175811914968c731fe6eb

    • SHA512

      f3390204d966682c06f71620457adea05b416d4cad9d1e76a500f5dfed454daeb6238390a3b3292ed4d99029949005746de28c17eb99a39de93c44d5bdfde420

    • SSDEEP

      24576:noJsus+r4SvupVlg2kjhwZmyaLfsts6Xjz:noJsus64S2KRaAhQs6Tz

    Score
    10/10
    massloggercollectioncredential_accessdiscoveryrezer0spywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks