Extracted

• • Target

    LYUoz7EXa2f53y3.exe

  • Size

    864KB

  • MD5

    1274d72e82a4a389f9bd063c4b025bc0

  • SHA1

    42bcb1cbe89361be9d538dffd2b71429ad7070cf

  • SHA256

    641fe8dbcfc7cf68d594eda921ce75269e4d3bb74a02b7116facb091020f0806

  • SHA512

    9699256cd3b4bea5a0230536639a00ae3ee41b6ff3cea851a31bf49d3a33af30a85a21921edd58321d85d3f19fce2b6a9eb95e2231f24da5b0df2e2d4d6ee0cc

  • SSDEEP

    24576:plv9Wc7NBpneCf6vw3j+7Tx3B4mNJA9fyRvZsAALCvoR:plv9Wc7/peCf6vkjkTn4ky9VLmC

  Score

  10^/10

  massloggercollectionrezer0spywarestealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger Main payload

  • ReZer0 packer

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2