Extracted

• • Target

    cec32706a7a76daa87ce84e365bbcd42d277f47cae98b60fdc1c0eae2cb30983

  • Size

    1.2MB

  • MD5

    5a165c7d791eb039603854d9a7fefcca

  • SHA1

    b47cbbef36f0f56c48612f3033e2a039ed1c9297

  • SHA256

    cec32706a7a76daa87ce84e365bbcd42d277f47cae98b60fdc1c0eae2cb30983

  • SHA512

    559dd55734420caf1495014740b8ebbab78edb9f62c6d1583e26c0166da69cbe622408c1b9e8e5a26944112870d70ab3d982f116845f64ae90e8782246698b00

  Score

  10^/10

  massloggercollectionspywarestealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger Main Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2