Extracted

• • Target

    ca6dbe9ccf2dbcf8cfa6cb04dada5d7caaa594fbfa83e424dda4f88911b4af6b

  • Size

    1.2MB

  • MD5

    57aed4d62cc8ed78cfb6b18c29d1ae05

  • SHA1

    2ad0e3ee508ed48d9af6c5c980651ffea3274993

  • SHA256

    ca6dbe9ccf2dbcf8cfa6cb04dada5d7caaa594fbfa83e424dda4f88911b4af6b

  • SHA512

    f24bd2d7dc0bed2d4f1d19fa4e6eb4c3f0f1994d5fd45a68dba1afdbf46d0dbf58883856f8b7cf68f8c3779138f72cdd52cf963ded5d13b6da7e9bea05169052

  Score

  10^/10

  massloggercollectionspywarestealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger Main Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2