Extracted

• • Target

    PO-4093021 copy.exe

  • Size

    805KB

  • MD5

    642da53966f1bf49b013e96fc9584ea7

  • SHA1

    3f0b9179ee12bf189c46bd06ba2ab29d17eadbff

  • SHA256

    3a85cb51540571b98adc8edbe330bf0169582553a2c3bdb81171ebb5761ae001

  • SHA512

    1a82c0a03189229a7d4d1ccf32bf6c184a8e32914648fcf175f65b7d4117c117a2d5df67156c145d705948763de02f69ee125cce2d5085db503a2899aa0e34b7

  • SSDEEP

    12288:6nJl5JiwLr7Etmver3O8ComsoG65ymQHjqy++r1giiUWhbtQnwOycVeTBdWk:6nJNiMQrwSTOajM+BNRYBjORV

  Score

  10^/10

  massloggercollectioncredential_accessdiscoveryspywarestealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger Main payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2