Extracted

• • Target

    09000000000000009.exe

  • Size

    741KB

  • MD5

    371f235c3625f124dee36379a46a8dba

  • SHA1

    23e1fcb3503ee740cdc67c8045e9b7c8c1babec8

  • SHA256

    ae1101f81ed495b405d0f80d678da0a6eff8e2f9c432734302ffb764b215de0a

  • SHA512

    a83c28b39989754ec3fd6d76ab55fcbf37a3b4fedb141962f8aa7fae7d1b681d5b95d9db0cd56025549f71d18b7748a9852f324e0c1a1d6fe4dba1bfd2431ebb

  • SSDEEP

    12288:ldCVE4Cn+bipNZmN0BueA63zIK48XqASE4zC1zmBVQEu9LPcfUdEkmrodF:jC9u8ifZmgueAGz4a6zC1UxoTQUa1ror

  Score

  10^/10

  persistencemassloggercollectionspywarestealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger Main payload

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/System.dll

  • Size

    11KB

  • MD5

    fccff8cb7a1067e23fd2e2b63971a8e1

  • SHA1

    30e2a9e137c1223a78a0f7b0bf96a1c361976d91

  • SHA256

    6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

  • SHA512

    f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

  • SSDEEP

    192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4

  Score

  3^/10
  behavioral3behavioral4

• • Target

    7g26jn92p7b.dll

  • Size

    14KB

  • MD5

    d4cd2de76cb5e3926b6ebbdb5d421490

  • SHA1

    9ba8904ab672d5761ff95c7db07ca249d000b0d0

  • SHA256

    4feb8ae08b605e9cd75f5a999c59cdb5b5ddc5dd6932b018ba0a4fa5ef6dd1d5

  • SHA512

    7acb5f7d6d204779ed5c232d8e5fc01cd7312f59631a68bd10944b221f3e45b573cefa61e236d977ce623e9d99f3ed3c5b64a8086cc6c30bd648eaabc36126e5

  • SSDEEP

    192:5zfMvg35JT5CQuF9RFNDaSL6SwcuULPYABqo011nzxwSlTgMMXioI:5fM8JiF9RfaSL6SwuYV1FxwSJ9

  Score

  6^/10

  persistence

  • Adds Run key to start application

    persistence
  behavioral5behavioral6