Extracted

• • Target

    IMG.EXE

  • Size

    790KB

  • MD5

    e37eaf4e6ba3f8f3c7ae69fe64fab426

  • SHA1

    2371f3f0b6f993a6a85016764fc515e21318acd6

  • SHA256

    686fa9c6fbea4f0c7ef43e699dc0635cde676b7e9b85846543367a0530c36b0d

  • SHA512

    eb833ba22f65f3dbceaafa87ab0e3f329cd710849dc08e8dd6972e2a291cb7ddceb90daabfa613e6310e18879e762ffaf051a8c10e36fd264b8f58eecf107142

  Score

  10^/10

  massloggercollectionpersistencespywarestealersuricata

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger Main Payload

  • MassLogger log file

    Detects a log file produced by MassLogger.

  • suricata: ET MALWARE MASSLOGGER Client Data Exfil (POST)

    suricata: ET MALWARE MASSLOGGER Client Data Exfil (POST)

    suricata

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2