Extracted

• • Target
    9ddb0e06b87cf5674f6f9a36de72f61487683d5bea023d9894b13a15ae14dcb3
  • Size 1.2MB
  • SHA256 9ddb0e06b87cf5674f6f9a36de72f61487683d5bea023d9894b13a15ae14dcb3
  • MD5 f59e76fec35f01ad7f96b7f745eb1876
  • SHA1 7bf2cacf634758d1106d75719577064e6546d7b7
  • SHA512 409fd7d9a5a6b87be9b14f38c391057d918fd8f79cfe2ed9ed0238d9cdc39c8fca2b6b3868835bc0c914c2e43692b79da13af3bdf27748dfbbc4c2132d7c4573
  • MD5 SHA1 SHA512

  Score

  10^/10

  massloggercollectionspywarestealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger Main Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2