Overview

overview

10

Static

static

3

DHL EXPRES...LE.exe

windows7-x64

10

DHL EXPRES...LE.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f70d9478af143696a062b8e6c8d0354359f9132faffb2dd569856dd48c374e35.zip

  • Size

    739KB

  • Sample

    250327-xn5dxaymx2

  • MD5

    a04e76097adfcb266e86f74778c11c40

  • SHA1

    22e004975797c6a93dcf319a8f0e851df9ae2194

  • SHA256

    f70d9478af143696a062b8e6c8d0354359f9132faffb2dd569856dd48c374e35

  • SHA512

    c763bfb6088970d2d606c065ea055bfcfe1b0eaf54e60c962e91fecb4d726cbdc4142c6f3d6e4072bb822f6df044091d417700296f17caac05dc75386b0cb953

  • SSDEEP

    12288:npsLg1Eui4gsCiGAwg5mrSJKMEd8orXJQQfdonw0y0UturSAQtYPKNeSzBjrpvxQ:psLg1FZgsz4rSI38orXJvfinw0pCtWK4

Score
10/10
massloggercollectiondiscoveryexecutionspywarestealer

Malware Config

Targets

    • Target

      DHL EXPRESS - AWB Numero 06785388011- CONSEGNA DI SPEDIZIONE ORIGINALE.exe

    • Size

      836KB

    • MD5

      405caf39727d3a92200815ef9c8af7ce

    • SHA1

      fa800cd7931827f27de4d501e28de0923b0df123

    • SHA256

      aeb6ea1657f98df189191a52f638937d0a2379dfa7406bd05f88c9afc965de31

    • SHA512

      a2a4c87bcd25543e1c441e921e3daa2249ae779089f61e88e5707c9d4f9a8131d98bbf77a3561fe07317e9c8920f89dfd3b1dffb6a5e5cac034b6521033396a0

    • SSDEEP

      24576:RB0jJG94uvrRgGMCvSaD6Vr9bS4RIGt/nE7a5m18:uJG94uvrRgGvkr9/trM

    Score
    10/10
    massloggercollectiondiscoveryexecutionspywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main payload

    • Masslogger family

      masslogger

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks