Extracted

• • Target
    fbcbfa3bae2c721a8923ef296e7f7140d3035a2cf711ab3df4d948eba6226446.exe
  • Size 1.1MB
  • SHA256 fbcbfa3bae2c721a8923ef296e7f7140d3035a2cf711ab3df4d948eba6226446
  • MD5 7c00ca581a2791d24954f3fbd347a3fe
  • SHA1 8cf6d4a96fdd20c4fa220b626f2762020e840192
  • SHA512 f70b1584e7fed001f886495dcf29a1c5852d15ee2a48aaaab691f8fcc76a814b99e036fffb5e9b16b8f3971f9577eee2082d9945ddebcae3a4ea824768ef1657
  • SSDEEP 24576:BMwl93McUMv/sc8gOnYp+2gGpyHl5p4Uo3ry0npvsIC:BMwlpagEcFD4GpyHlEPugp9C
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectiondiscoverydownloaderguloadermassloggerspywarestealer

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Masslogger family

    masslogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 b7823a15e7b1866ba3d77248f750b66505859d264cfc39d8c8c5e812f8ae4a81
  • MD5 a1da6788aeaf78ca4ae1dece8019e49d
  • SHA1 d770155e6e9aa69223be198c44a8da26a1756d89
  • SHA512 eada9c1528563ddfe3d4d8ed5dbc52b85a9190765535b68da90e6d623288bf0090adac5118e1ed6e3cb3e0abb9af025d3a2a73121413a4471a90fd04bc861e18
  • SSDEEP 192:uenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBUIwL:u8+Qlt70Fj/lQRY/9Vjj+L
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 9KB
  • SHA256 48c290cf400a8e3a5e6cded2f4817d344c4d20745c8659cccbc09edad5866dc0
  • MD5 9cbefc918a4560f3e780bc927e0e4008
  • SHA1 4c23e9947f5d2338b4cfeb870cc9f9dcb7ee37e3
  • SHA512 7a11aeba9bfe309c9baaa9bd907218b238fd09a98c55c5d34949b8f5b4b6402e3efb7cb3279c211459cb6d27b689896c0a54ed92155d25f5828d18377a5b4bff
  • SSDEEP 96:o1svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YrJNqkz6:o1svWyNO81b8pCHFcM0PuAgkOybIFc
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral5behavioral6