Extracted

• • Target
    YKjeKrJd4FXnXs8.exe
  • Size 937KB
  • SHA256 70caf501b061da2729d33d4b0c5e9b9c58bc554cdbdddef16f7e057ea346808c
  • MD5 0098ade3b0d25eee4fbd318e508c2102
  • SHA1 febd998e001c6abcaee00447c8f21eb103d81bff
  • SHA512 0f00b495b694c28f0abe22677dfb51270bda23393dbb12c5d3b80cd30fab8b9fb42fac35dbbab7ecc8d90bedd7d8546ba427a7a770db615ccd4662ebd81a3f28
  • MD5 SHA1 SHA512

  Score

  10^/10

  evasionstealerspywaremasslogger

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger Main Payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2