Extracted

• • Target
    PROJECT RFQ.exe
  • Size 775KB
  • SHA256 5b32ffc4c10114b55115da9f2c6e4ee22222f5d305552daf00a287b82d66c9dc
  • MD5 edb9ce3fb683ac12c72ce836dfcdb6a0
  • SHA1 c1d39316e68e9805f4922bc6451730d1f4f67f31
  • SHA512 25137ad206f5172c9091501c797f21ee4834d611a9e689eb84b8b3c459ebee80d217e6e901bda31f4a58a3610a77414972476c030c676f24ec54212a3618fe7e
  • MD5 SHA1 SHA512

  Score

  10^/10

  massloggerpersistencespywarestealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger Main Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies service

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2