Extracted

• • Target
    Machine drawing.exe
  • Size 1.2MB
  • SHA256 0728fd4058762cdab5e5366f0e353fc86437707048e0a5a915a1d2c433a67c7c
  • MD5 436f1f00588b42189b6f818fa15af051
  • SHA1 be1a3ad589f9ec581470ed9a91cdfc950df37b1a
  • SHA512 b857dd36cd40e32303eed2a544ce4cddf45752f4861bb4691ac6c6f5994d6d0d358c5b6bece0e142c88e133b1f66fff494c05c86a1e716ab4b593b407afcb7cd
  • MD5 SHA1 SHA512

  Score

  10^/10

  massloggerpersistencespywarestealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger Main Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2