Extracted

Extracted

• • Target
    Synviro_Quotation#90311.pdf.exe
  • Size 1.5MB
  • SHA256 d7fde69a82dd7aabc7582e97f6906ff0ee92ed4ead6a2486d7c19c6807206a9d
  • MD5 24c6cadd820713e2fc93d904ee398905
  • SHA1 da53f7f789da4285dc07de762aaa1545e2f136e5
  • SHA512 a32455d7caacf5806aeace969072e7b54ca76a138b07c3f290a08d6076f6eb9c70222b98c7347336c17e962044b0fe4f4ab102ecd0e9a9a28791abf24fc5f376
  • SSDEEP 24576:ngWVBgxaPRHPgkV3C3wXB8dm4D0yzNcOtlfNP4MBFqXFkphKmRkAXrGCU3eu/6QE:nTVBg+0C0L4yVSReJQE
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  darktortillamassloggercollectioncrypterdiscoveryloaderspywarestealer

  • Darktortilla

    DarkTortilla is a highly configurable .NET based crypter that delivers a wide range of information stealers.

    loadercrypterdarktortilla

  • Darktortilla family

    darktortilla

  • Detects Darktortilla crypter.

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Masslogger family

    masslogger

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1