Extracted

• • Target

    abe5e19af6c26a046267d78c9803ed3bc844a4b87a5764eb51d88073a0a8e572

  • Size

    1.1MB

  • MD5

    842e4774dacff5b4f54f90f8837025f3

  • SHA1

    70cd13699bfeec183bc055905e3a74af0dbc2b2f

  • SHA256

    abe5e19af6c26a046267d78c9803ed3bc844a4b87a5764eb51d88073a0a8e572

  • SHA512

    07776e0ec5c98cf1b0ea1c5e88e12e945c09dfeeabd054b08d271e2a38b5a9ae9f9cb6ed9930c37b5cb43f36433c8f837ce0982015327eacafae36f9f087d240

  Score

  10^/10

  massloggercollectionspywarestealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger Main Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2