Extracted

• • Target
    SKM_C25820112116120.exe
  • Size 1.2MB
  • SHA256 5f53adb34adbcb6eeec29d48e9d80a401d1476eff2e826cb2c7ac02d8d7e2785
  • MD5 2559a4a701f88d7793082cea77f7a73c
  • SHA1 5548a12e53461128020f9feaefdeac7f797e2830
  • SHA512 a929420bb0bb9fc22262dbec8145a3c451e241a096c18eb3bd3e78c7766e5b021fcc9462477ea58866f4b329d65a2f2e3ec738fbf64d4dadd201cb3eab428ca2
  • MD5 SHA1 SHA512

  Score

  10^/10

  massloggerspywarestealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger Main Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2