Behavioral task
behavioral1
Sample
e64ff6e23ce8911e74ee402d2cc1ed3d54998a56a6fb272b50c5a87363975305.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e64ff6e23ce8911e74ee402d2cc1ed3d54998a56a6fb272b50c5a87363975305.exe
Resource
win10v2004-20250313-en
General
-
Target
8be83afa0d49f32ec1cb69a80b9bbf2774dc4be8a7209299ef62a7e408e673a9.zip
-
Size
357KB
-
MD5
a91929a48a362b3e40b0725672a43291
-
SHA1
df7e6cfab70e0134468f2f3bc2cc3c076773149d
-
SHA256
8be83afa0d49f32ec1cb69a80b9bbf2774dc4be8a7209299ef62a7e408e673a9
-
SHA512
1ff4f71b5180f517d55e09afd89b9815a715090db60a93d2be6c29605de06ed83f5e53b7ffb04e71e293b05caa62e8caa5b3834fc29a080fd839cacc3978488a
-
SSDEEP
6144:vW4Q0WZSdr4dJweN8DSH2Wlfij0Er2b/E8rKVHhzPncyO/gZoMvTzsGW6TTTZk4N:Ov0Wgr4dR8DbWlawEr2b/Sch/gCMvEFm
Malware Config
Signatures
-
MassLogger Main payload 1 IoCs
resource yara_rule static1/unpack001/e64ff6e23ce8911e74ee402d2cc1ed3d54998a56a6fb272b50c5a87363975305.exe family_masslogger -
Masslogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/e64ff6e23ce8911e74ee402d2cc1ed3d54998a56a6fb272b50c5a87363975305.exe
Files
-
8be83afa0d49f32ec1cb69a80b9bbf2774dc4be8a7209299ef62a7e408e673a9.zip.zip
Password: infected
-
e64ff6e23ce8911e74ee402d2cc1ed3d54998a56a6fb272b50c5a87363975305.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 511KB - Virtual size: 510KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ