General
-
Target
efda5b6570d56f9c9fb244211e1c1eec_JaffaCakes118
-
Size
1.3MB
-
Sample
240921-p9asestbnf
-
MD5
efda5b6570d56f9c9fb244211e1c1eec
-
SHA1
814806bf2b01322c03e37988937e62fa924b0ffe
-
SHA256
f63fab350ae884c55e1e399abfdec150a3db27402311dc5d48ce6ef101930a4d
-
SHA512
c08c8bc263852bd9bef67bd1856472fe87994be91bc298669c7c596c465a9501994826a86ec4c093cdb38e149cee453f074018307e3240d72ef79f38040ac4df
-
SSDEEP
24576:Tiwoh1pK7twlZ+lKp7KZ6lxV1iqCTuO9MNj:GK7tW+Mp0I1bBl
Static task
static1
Behavioral task
behavioral1
Sample
DHL_May 2020 at 06.1_8C7290_PDF.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
DHL_May 2020 at 06.1_8C7290_PDF.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
Protocol: smtp- Host:
mail.kogep-k.hu - Port:
587 - Username:
[email protected] - Password:
Vb^4ZJR[JffqT,F2Tb
Targets
-
-
Target
DHL_May 2020 at 06.1_8C7290_PDF.exe
-
Size
805KB
-
MD5
e4707e252ef3e7a6477c63a1a0350129
-
SHA1
c5152a955485460d7c4bab092c5cebaf314ec092
-
SHA256
7573a215a8c55cef7dd88267f3df3561fea190c207eb09cae2b59641945748d4
-
SHA512
86f90725cd0dd098379c562ce311887f1c35a2a72d7c261f1544b8103265ded071408725250f1756e6b3b862fabaf0619a4b44d894b8643462998358ee428641
-
SSDEEP
24576:yiwoh1pK7twlZ+lKp7KZ6lxV1iqCTuO9MNj:PK7tW+Mp0I1bBl
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main payload
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-