Extracted

Extracted

• • Target
    RFQ-SDS-11152022(1)_20250215095300.635_X.vbs
  • Size 248KB
  • SHA256 10d96a57b4a446b30816229307984a151f1d319eb8e25fdffb0b6185055f778a
  • MD5 ad61ec87cf6c3eed61d66cfebcb663bd
  • SHA1 d5ed3157984f8c1034d1c59703add06fc828404e
  • SHA512 ee3265bd36b2d608124dc58c6049ece57c796bb8aa788a11572a02a2d0cfeea854b3bf17c743457e2b36722e685da4175118a37eefc223ca1b49ed71f6c2aa7d
  • SSDEEP 6144:R5foAiRXNhTJuPUqd/KeqvqU+J6VzgYh1G5T6wBhyKr2V37oncOG51TnrK:qTJD+J6VBwBcC
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectiondiscoveryexecutionmassloggerspywarestealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Masslogger family

    masslogger

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2