Extracted

• • Target
    5 days Itinerery.doc
  • Size 525KB
  • SHA256 19016227bbad1d388ed7c0ad968a882e7e7702457257426931f6d6005eea5472
  • MD5 3e61c3fcfbce2d0100a3b4c8fcbdb945
  • SHA1 6f6673ab5b88a1f3f9b651026957c3a333657040
  • SHA512 1f2570e4e1c306c885adaac8e3103f0f7f127641ed9d49d2f5d96d151f80d1a5e591b592f098cf3b19b80da7512df5c8d092c031e95cd7c1e6cba4dbc4d5cd98
  • MD5 SHA1 SHA512

  Score

  10^/10

  massloggerransomwarespywarestealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger Main Payload

  • MassLogger log file

    Detects a log file produced by MassLogger.

  • ServiceHost packer

    Detects ServiceHost packer used for .NET malware

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2