Extracted

• • Target

    Ekstre.exe

  • Size

    1.2MB

  • MD5

    89f1f5656da031a2efc09c53e4be99de

  • SHA1

    889b3da7c04df4f5ada7c3ee11742854399e20b0

  • SHA256

    18dce314a1d5ad6712fd2b1f80955c00155ec16e66e1039ac77c1849aa913577

  • SHA512

    39b8e7b71f13e486db5032057a4d3bf9cce5ff407eda21f802d782f66e53f924e2dab3b6244341c94d7fe273643cfcd96eecf3affefca3cccfeedcf031062c81

  Score

  10^/10

  massloggerpersistencespywarestealercollectionransomware

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger Main Payload

  • MassLogger log file

    Detects a log file produced by MassLogger.

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2