Extracted

• • Target
    SOA.exe
  • Size 566KB
  • SHA256 ff319430f00da8eebd3b92f0d494c1dd9bee7f9ef3a8101dda2ce14968b9811a
  • MD5 d7c652c08d32714b0beaf991d26ca600
  • SHA1 67e6ebc692ba64c54e254ff6415733b8778eda7c
  • SHA512 656f4e6adf0dd2a17abc0a943b164c19c4575aba8f731b9f7c6dda8f88e9aa3d3b775379dbb044ae63aae87553d0883acbc1366a7adac6fba569c623d4b15ca5
  • SSDEEP 12288:W8nl4S2PvH5+7E8nWgfR/49hWZOlL8MxPMsbhHE:hnKBvHkAsflGhOOl1xEsy
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  massloggercollectiondiscoveryexecutionspywarestealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Masslogger family

    masslogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2