Extracted

• • Target
    ca6dbe9ccf2dbcf8cfa6cb04dada5d7caaa594fbfa83e424dda4f88911b4af6b
  • Size 1.2MB
  • SHA256 ca6dbe9ccf2dbcf8cfa6cb04dada5d7caaa594fbfa83e424dda4f88911b4af6b
  • MD5 57aed4d62cc8ed78cfb6b18c29d1ae05
  • SHA1 2ad0e3ee508ed48d9af6c5c980651ffea3274993
  • SHA512 f24bd2d7dc0bed2d4f1d19fa4e6eb4c3f0f1994d5fd45a68dba1afdbf46d0dbf58883856f8b7cf68f8c3779138f72cdd52cf963ded5d13b6da7e9bea05169052
  • MD5 SHA1 SHA512

  Score

  10^/10

  massloggercollectionspywarestealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger Main Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2