Extracted

Extracted

• • Target
    63e47d7fccd41dc818b81c1514586e42e76fa780b655cd3c3b0e336485e8ca25.exe
  • Size 700KB
  • SHA256 63e47d7fccd41dc818b81c1514586e42e76fa780b655cd3c3b0e336485e8ca25
  • MD5 d4ef5e14f44b57feaca38225a5c2c34f
  • SHA1 2bebf797b55a763c2d5da4dca246df9b2ef42ddc
  • SHA512 150d11e6d4424885c5b7a1e6fadd0a6f2aaf619710d3b4564053769c1a770023cb7664f2901283745f186dd9d33db41ced887ffc12d94b6cb4ba5c6f5a206ff0
  • SSDEEP 12288:eovssltf7VyGAxzpL5uJcayQbcYL7d79GvR0fLP9v0//7V/en30TVKXB0mixur:pvsslFPwL58caFtl7HVM7eEBqB0txe
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  massloggercollectiondiscoveryexecutionspywarestealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Masslogger family

    masslogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2