Extracted

• • Target
    1a59f7713b3a268e3363e5e56e598e5f43e53aef9b383615f7ae32b74ba6ed00
  • Size 952KB
  • SHA256 1a59f7713b3a268e3363e5e56e598e5f43e53aef9b383615f7ae32b74ba6ed00
  • MD5 520a0e341f7737d7df9cf0e4d0c50061
  • SHA1 35bb57ddf453b9bac4c7d4e89979dc198d9cb665
  • SHA512 b75d45a9c6cca339d9a2db98726e7baef1f32ada6ced2f131f9df479883d0d4eba3cc66b71eb2419fa672b9b096ec4418335fcd65f484ff9781de39f30354834
  • MD5 SHA1 SHA512

  Score

  10^/10

  massloggercollectionspywarestealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger Main Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2