Extracted

• • Target
    hesap hareketleriniz.bin
  • Size 92KB
  • SHA256 4aceb37332d3353fcfdc0fa6cdcf21ca3f675689d69ad84dd0e397f6ffa57cbd
  • MD5 ae6c2cee9ea5dd18f83d07a9b508b2ca
  • SHA1 efa48d08f08cfd59c2db9a5be430b7aefdd5973a
  • SHA512 f4279a56dc0f30d629fa4d086401d22b94b56bcd43ddb514a0d9b48572bd73f1568eaf08e67f4ae24d0626b716f33c710b0d8d6751dfd5ed2950a8b08891b4f0
  • MD5 SHA1 SHA512

  Score

  10^/10

  massloggerpersistencespywarestealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger Main Payload

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2