Extracted

• • Target

    fc10ffaccc0a45c6c884dccd218af7afe3fefcccd8973f5aa50b23fba05d3ca4

  • Size

    640KB

  • MD5

    366e3c080ecfdf6882c6a40ed7ce2667

  • SHA1

    54acfcce862f6a8313692623f3b6d4020b671edf

  • SHA256

    fc10ffaccc0a45c6c884dccd218af7afe3fefcccd8973f5aa50b23fba05d3ca4

  • SHA512

    e4f0574b200facfe486484b1783096869ce52005659fcbd2557d9e830753597d320155baf4e5fa053a0da0f0aeba45220e6ff7e5d31c35ae9d5831cc5a0076b2

  Score

  10^/10

  massloggercollectionspywarestealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger Main Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2