Overview

overview

10

Static

static

PROJECT-0039382.exe

windows7_x64

10

PROJECT-0039382.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    PROJECT-0039382.exe
  • Size 363KB
  • Sample201109-nch2pfmp2x
  • SHA256 1136fada0e7737d8ea5304cb8e85550cf1ca35e2b64bfa6e000b07d5c428f7d7
  • MD5 SHA1 SHA512
Score
10/10
m00nd3v_loggercoreentityrezer0spywarestealer

Malware Config

Extracted

Credentials
  • Protocol

    smtp
  • Host

    mail.privateemail.com
  • Port

    587
  • Username

    [email protected]
  • Password

    NoWorkNoPay@

Targets

    • Target
      PROJECT-0039382.exe
    • Size 363KB
    • SHA256 1136fada0e7737d8ea5304cb8e85550cf1ca35e2b64bfa6e000b07d5c428f7d7
    • MD5 SHA1 SHA512
    Score
    10/10
    m00nd3v_loggercoreentityrezer0spywarestealer

    • CoreEntity .NET Packer

      A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

      coreentity

    • M00nd3v_Logger

      M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

      stealerspywarem00nd3v_logger

    • M00nD3v Logger Payload

      Detects M00nD3v Logger payload in memory.

    • rezer0

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Uses the VBS compiler for execution

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks