Extracted

Extracted

• • Target
    5240a9ff514c4c31fa548a21ef76f684efb7b62edb0b2db9cc5fbaa00e73b87b.exe
  • Size 515KB
  • SHA256 5240a9ff514c4c31fa548a21ef76f684efb7b62edb0b2db9cc5fbaa00e73b87b
  • MD5 64f950175ed6c68e51c34db1c2dab3ee
  • SHA1 98a8d4a1dddd0219b0b9057c7e510664165b6177
  • SHA512 75e439369cdf64a4dc137b9b54be42b1c9c053e9cdc913490d572e85d0a9c6bc3214c700ac5a71db7fa226ee52126d647c01433b4cf0f803cc2787aabe236376
  • SSDEEP 12288:WmW3Su0yg+FlLilyCnlhSqFSu5VSfLBVmfow1eW73nkR:Be0yznMRnl4Q9VSCfogeWby
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectiondiscoveryexecutionmassloggerpersistencespywarestealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Masslogger family

    masslogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1