Extracted

• • Target

    10b88ac8b8f3eadacaaafc13548973db3f2e48c681801fb05d6bfe88c3fbe2d1

  • Size

    1.2MB

  • MD5

    6dcf680a1915d66a2a596a823cfd91e1

  • SHA1

    e4950f369f8f3c3b94bd93f917a116893b1cbee2

  • SHA256

    10b88ac8b8f3eadacaaafc13548973db3f2e48c681801fb05d6bfe88c3fbe2d1

  • SHA512

    ca189943e1513b705e61b68f290bdb8d22a56d6024fccdf6b477e2ac979b0d695ca7918742fb90853ae79d70c7c99533409c2873b8a90cd88a1caf3be0a3cd10

  Score

  10^/10

  massloggercollectionspywarestealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger Main Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2