Extracted

• • Target
    yp3E2QR8CeZp9Au.exe
  • Size 1.1MB
  • SHA256 96c020d574c159341ab1d2dd8029637423bf01286bf930a34a5c9af605d01532
  • MD5 de11c29c6a5736ddfdfa96cda2f9fa82
  • SHA1 07799b8ebb13829c45607cf1b3675bc4c1584298
  • SHA512 44f082cc16ef54a645c492587773011a5aadb47117992f347919feb411da573af9d2fad197ad3d06ce96383500304e67092a6120dc25815d2411a7577aadb758
  • MD5 SHA1 SHA512

  Score

  10^/10

  spywarestealermasslogger

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger Main Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2