Extracted

• • Target

    Document_028472.exe

  • Size

    905KB

  • MD5

    d82790a83761efb5c7727fb60db48723

  • SHA1

    0345bbca4671daf283f40b20fa477ed8a84ba9a4

  • SHA256

    f305b0d150fd1cae5ece3e13a86f95d7a4f25683930a57988878198b7f547ba4

  • SHA512

    bb835bb5a954e206a3605eebee9ecaa6986af0e8a222fcb8108eb62ca856b183c10f2c58efcad803a47aabf70122cfe288a484a76eced03d74d6a6a06615422d

  • SSDEEP

    12288:yFg3OaHjYaVymEzQSpHVNmLkS2i8fHLO2HyjJasQlYOUDhw0Gey7awQAtfDAvwIq:ZjYa5SHNU2XzPH8JHrC0LmawQnvw

  Score

  10^/10

  massloggercollectiondiscoveryrezer0spywarestealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger Main payload

  • ReZer0 packer

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2