Extracted

• • Target
    Swift Email Bildirimi pdf.exe
  • Size 1.2MB
  • SHA256 3a174a8823aea425c1e4faae5879a783f18df206c436d12995e015448428caa3
  • MD5 6c9c19ecfb3a2a66ed8ea54b39c15acf
  • SHA1 083ad213dd1443eea25f267f270c3f026a889044
  • SHA512 03117789059fd1ed501e14484257e145f0a7cf888111550612051099cc34334717abc2083bebbec5577726b63db05f95eb94a1c5d9628a7bc3c61862db7fde87
  • MD5 SHA1 SHA512

  Score

  10^/10

  stealerspywaremassloggerevasion

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger Main Payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2