Extracted

• • Target
    62ba72c8e528303083fadcd97e95c3115bf1982e6d1516472dfd0c9abbf8e0cc
  • Size 1.0MB
  • SHA256 62ba72c8e528303083fadcd97e95c3115bf1982e6d1516472dfd0c9abbf8e0cc
  • MD5 a5f465e80c730365bef7d2016a06b4e8
  • SHA1 47556b655932468d093df342fbf37049b7baf55c
  • SHA512 cc487ffee2dcacb9e93ef81020725ae672d36e7b5599c1e7e751c1cb09cace941509410014fba3721cfa2a4801f1c02ac0f297cf96b26fea739d9b4f8f11166f
  • MD5 SHA1 SHA512

  Score

  10^/10

  massloggercollectionspywarestealermetastealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger Main Payload

  • Meta Stealer Stealer

    Meta Stealer steals passwords stored in browsers, written in C++.

    stealermetastealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2