Extracted

• • Target

    0461cd6c0d0a0c2b2987598f900c28decc01174af345897823a10118d7689249

  • Size

    2.2MB

  • MD5

    bc5b6c3533eb2b20b6c46fcb67d0ae8f

  • SHA1

    b10c0d14b9d59390b92dc5779d1c152714e56191

  • SHA256

    0461cd6c0d0a0c2b2987598f900c28decc01174af345897823a10118d7689249

  • SHA512

    60b4ed338d52b932d2741eb96fe10bf5c0d21f8082dc37e03c1622e0349eea331cf6bbb6215567ca0103cbcafe20d62b72f9e912f85b302b269bb7515a45aa5e

  Score

  10^/10

  massloggercollectionspywarestealerupx

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger log file

    Detects a log file produced by MassLogger.

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2