Extracted

• • Target

    Ekstre.exe

  • Size

    1.2MB

  • MD5

    4fa8f3fb34c79b408d7c511c892358cf

  • SHA1

    eded4cc6941f2ebf7d9b08bc98d05190c4d9e054

  • SHA256

    9343011118ad09e9a63a24adb5cc08f406ffc927230b1be998cb263ebf23eedd

  • SHA512

    832d9aaa4806edfdafba5fbcd6b46be87a9432ba5f56328b8254a8a8c2d0d5176a0eb2570c3fa36c0e0a94c27f9d28165e824bcd7249defabac6454b963633a8

  Score

  10^/10

  massloggerpersistencespywarestealercollectionransomware

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger Main Payload

  • MassLogger log file

    Detects a log file produced by MassLogger.

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2