Extracted

• • Target
    SPECIFICATIONS.exe
  • Size 730KB
  • SHA256 861b9d85f642873dd0f034f6f946e3791c4cf94c6687527320d26a2f217fa04c
  • MD5 d0204703673b11521c47cc743f7bb392
  • SHA1 11c66e3cc6b73eca999eb2dcd9bf2700bb4a9576
  • SHA512 9142e05eda00d518d71f60c4b54bf3aaad381fe6d5feae7af2882f6542c63e873188161c34fcf17f30cffe5c71c752b0be68e378e2981f19cc7e0bf0ac9069a8
  • SSDEEP 12288:u+AvuDU+cYHi0cpE3zIBBaVNxza4cUpgOP8VBfTjm33b3+e6xsInPWBXLpuUBFpF:u+AvuDU+cYC0cpE3zIBofxe4cUp36Bj0
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  massloggercollectiondiscoveryexecutionspywarestealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Masslogger family

    masslogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2