Extracted

• • Target

    REVISE ORDER.exe

  • Size

    804KB

  • MD5

    cf41831924a9e271522a59b8cfa7e9bc

  • SHA1

    624d9d1ff349e8fddfb93dfb277c3f93d20cd625

  • SHA256

    069f0dc72189e7faf5278aabd6ba9f53c386023f9d7d8ab863896e43f6a4e456

  • SHA512

    562e01c7c9d935cab4b980407dc8955316bfd3acc61db304ab06df6e37dcccf9d77f0fb5c6907f4dfde751a5b4635879d1a34e7bb119fba0e1e32fd2abb6dedd

  Score

  10^/10

  massloggercollectionspywarestealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger log file

    Detects a log file produced by MassLogger.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2