Extracted

• • Target

    b3b7c25b19f543b3aec9c5bdc7ee48ef52a95e491a6c41e1ff717e7723c4d64f

  • Size

    1.2MB

  • MD5

    d07a09607469ef8691d34d81376125cc

  • SHA1

    6b5fa836c06af55cdd45d257718f24723f280b1d

  • SHA256

    b3b7c25b19f543b3aec9c5bdc7ee48ef52a95e491a6c41e1ff717e7723c4d64f

  • SHA512

    1791eb8143bbf0060d38590a723d8b96bbddf0292e3840a6febd4e50cc19ab02d96bdd1f8042ffa267ce1cd0c182d7eeac9f3883a632f829000edb0091a01295

  Score

  10^/10

  massloggercollectionspywarestealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger Main Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2