Extracted

• • Target

    b670532dbe1f78e7479648c015756837_JaffaCakes118

  • Size

    992KB

  • MD5

    b670532dbe1f78e7479648c015756837

  • SHA1

    631002f475e0bebc74c4896b294eced0d6758946

  • SHA256

    6086e45ae6ae2ddfa775d72355d5c9a4c6d9aab84c96412af7d4a1b82ed6f28d

  • SHA512

    e1e6acbbc95707d6a6782dbb8bcc70c132ecdeffe6f3e9fd749716e45505193b47bd2f29e56cb514c444c3400a52888f2f05c9a0b0430c7cd5b336c6d7c3b8d1

  • SSDEEP

    24576:8NV2pSdrMvP3ApiuTS9ei8jtytauDQBvlZ:vMEfciuRi8MQA8vl

  Score

  10^/10

  massloggercollectionspywarestealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger Main payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2