Extracted

• • Target
    QUOTATION 014-S180053A.exe
  • Size 930KB
  • SHA256 a558950f60aa2a7e34ac71c8a3013fbf576f485a9468ecfe5fdb0a1abb2cafbe
  • MD5 aa8e4701cc7dc3b6ff21b601a685f090
  • SHA1 113a1704502e32ddeeab2abb90028dd49d4d9bf8
  • SHA512 31bec320c7a2367e845e3249ecf567e2fc7902a307eb3c6b7caa2e576c12c9b7ac421627db88f2631af78ab06f9faaca5f2381fffa90443c63d5b7930c8229b9
  • MD5 SHA1 SHA512

  Score

  10^/10

  massloggerspywarestealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger Main Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2