Extracted

• • Target

    08ecb2eaa2297e591f2832fe29271ce3467d718510c4bd89bc8fb1e46f6182b2

  • Size

    1.1MB

  • MD5

    f2e41102b332ccc34d58b83de6475a4d

  • SHA1

    ffc375e3d8139fe42982639dcc9c9adc2c262f84

  • SHA256

    08ecb2eaa2297e591f2832fe29271ce3467d718510c4bd89bc8fb1e46f6182b2

  • SHA512

    5161e6223e19519b0684a7d8737d68b58b0dcfa18fa6abed1de12d447b858a8ee8ef97d2484a66989b28bc61f6dc6e59f0f71a482503a355c6e99389e865c245

  Score

  10^/10

  massloggercollectionspywarestealermetastealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger Main Payload

  • Meta Stealer Stealer

    Meta Stealer steals passwords stored in browsers, written in C++.

    stealermetastealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2