Extracted

• • Target
    b3b7c25b19f543b3aec9c5bdc7ee48ef52a95e491a6c41e1ff717e7723c4d64f
  • Size 1.2MB
  • SHA256 b3b7c25b19f543b3aec9c5bdc7ee48ef52a95e491a6c41e1ff717e7723c4d64f
  • MD5 d07a09607469ef8691d34d81376125cc
  • SHA1 6b5fa836c06af55cdd45d257718f24723f280b1d
  • SHA512 1791eb8143bbf0060d38590a723d8b96bbddf0292e3840a6febd4e50cc19ab02d96bdd1f8042ffa267ce1cd0c182d7eeac9f3883a632f829000edb0091a01295
  • MD5 SHA1 SHA512

  Score

  10^/10

  massloggercollectionspywarestealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger Main Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2