Extracted

• • Target
    SecuriteInfo.com.Win32.MalwareX-gen.20415.13206.exe
  • Size 538KB
  • SHA256 99eb21753db52508e65ced48f7f5dae3fb00a288e22dd1d54df7bca78f394bb7
  • MD5 e9f0a212e050ce27e61196152f883b32
  • SHA1 3a1e358430d35bd1790637d582fb4a297702d50d
  • SHA512 5dd707580958966bb4744bb4f95a98f700e8c6bd7c701cf6734199b515643d78cc67f9ab46a640fb9771f2e21e4ed884c77d565ca296fde94114cd74dcd1af20
  • SSDEEP 6144:rgX+oBaWR2GGexmwCVA70tDtUSEq4nG49IpeBB6rucyiyv8LZZ5lxaPu6r57gjSU:szGoCPkfjwScybv8LZPlxryVgjSDkJ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  massloggercollectiondiscoveryexecutionspywarestealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Masslogger family

    masslogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2