Extracted

• • Target

    ab0a502bd72ea956ae55776e9ce491f5696d901eabfbbb10e99fd188f3ccf153

  • Size

    916KB

  • MD5

    9fb349f53e2f2a3c9c4d861c2be9d34d

  • SHA1

    0a7b443d12c57959ae5197c58615d0cdd2f8e5c0

  • SHA256

    ab0a502bd72ea956ae55776e9ce491f5696d901eabfbbb10e99fd188f3ccf153

  • SHA512

    f1c5b31d61148372e17496a2ecea47abf955f0e76243c3470a8dd2a2c5faa55c440f87141a56638de22e25b1420f2b88c9c105bfe90fb040edb8279d61d2f224

  Score

  10^/10

  massloggercollectionspywarestealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger Main Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2