Extracted

• • Target

    kmd.exe

  • Size

    1.8MB

  • MD5

    9906e3d9a42e2053405b72c9f85b0bad

  • SHA1

    06d5be5ef404c61a41d15bab8351aed6fb9ab310

  • SHA256

    13dd79b77c2ed2ba77d509e2d3b4621e83f7105674353f7e30930e07b099bce5

  • SHA512

    ad23480af230afb2fb447aee7386da6b106bc2b375c2270b3803526cd7e83eb5cea59469dab9bc21c099d809389ebd8dc0176bb6a357b45e473d9b6774e4a062

  Score

  10^/10

  massloggercollectionspywarestealerupx

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger log file

    Detects a log file produced by MassLogger.

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2