Extracted

• • Target

    a290620ed6254f949f4c6b93efa0979f038d4320f9f7cd6ae071229ae1627f59

  • Size

    1.3MB

  • MD5

    88fb1d0c6b9d0c60bf81723d0ba9a2d7

  • SHA1

    8623027c23aa355fe8b158a86d106d47eb40a6c4

  • SHA256

    a290620ed6254f949f4c6b93efa0979f038d4320f9f7cd6ae071229ae1627f59

  • SHA512

    c70ae9ed013384cb14d078742642757bb29871ecbd69992083d40df91ec3a1a01e791ef38a8be4be0c589b082b6dca9cb075327c7616c8733dfc5fd5ae0530bc

  Score

  10^/10

  massloggercollectionspywarestealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger Main Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2