Extracted

• • Target
    PSM.exe
  • Size 1.8MB
  • SHA256 c51d3c8be3936b476ac729e5ddc15eb4dcd5dea18dbcf8200f0767b33ab0b076
  • MD5 1bd01776fa634416bbc39f55bf970f23
  • SHA1 953e33974f802b6c7a2eb5affdd52976e6d12aef
  • SHA512 fbc2233b4198537e4d8c1c65e00c6a7bd9b9d014fcb97d3264c849361a2cada85e4d026855948e47f9c3325b313c689e161d5e233932ef6cb7b35b101e9827ad
  • MD5 SHA1 SHA512

  Score

  10^/10

  m00nd3v_loggerspywarestealer

  • M00nd3v_Logger

    M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

    stealerspywarem00nd3v_logger

  • M00nD3v Logger Payload

    Detects M00nD3v Logger payload in memory.

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Uses the VBS compiler for execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2