Extracted

• • Target
    330bad5ede053221123bca714de49be678bbfcf42127b4e1b9d187bdea007875.exe
  • Size 744KB
  • SHA256 330bad5ede053221123bca714de49be678bbfcf42127b4e1b9d187bdea007875
  • MD5 d9866faebab6c6a5e62b21e2bb531d55
  • SHA1 452bd074ef5931fde091fb9f39460c89e0e595ea
  • SHA512 4cd1b4babb022f3833abec7b34e9d1db4b080111b2ef21129d0461f57227b9670f687f786ab09c9afbc6635ce0cbcc5ee14a7c38030b6d605097e3600ebed7d7
  • SSDEEP 12288:mTPnvp0CjM4oL3580SP6kqiLtzGplObbY+Z7IUEuBOhPUFCmw2G57AxMQd4y/69Y:mTPnv2taFP6kXL1GXObbTjbgPUF9TG5y
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectiondiscoverymassloggerspywarestealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Masslogger family

    masslogger

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 b7823a15e7b1866ba3d77248f750b66505859d264cfc39d8c8c5e812f8ae4a81
  • MD5 a1da6788aeaf78ca4ae1dece8019e49d
  • SHA1 d770155e6e9aa69223be198c44a8da26a1756d89
  • SHA512 eada9c1528563ddfe3d4d8ed5dbc52b85a9190765535b68da90e6d623288bf0090adac5118e1ed6e3cb3e0abb9af025d3a2a73121413a4471a90fd04bc861e18
  • SSDEEP 192:uenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBUIwL:u8+Qlt70Fj/lQRY/9Vjj+L
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 9KB
  • SHA256 48c290cf400a8e3a5e6cded2f4817d344c4d20745c8659cccbc09edad5866dc0
  • MD5 9cbefc918a4560f3e780bc927e0e4008
  • SHA1 4c23e9947f5d2338b4cfeb870cc9f9dcb7ee37e3
  • SHA512 7a11aeba9bfe309c9baaa9bd907218b238fd09a98c55c5d34949b8f5b4b6402e3efb7cb3279c211459cb6d27b689896c0a54ed92155d25f5828d18377a5b4bff
  • SSDEEP 96:o1svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YrJNqkz6:o1svWyNO81b8pCHFcM0PuAgkOybIFc
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral5behavioral6
• • Target
    $WINDIR/upwork/Rekompensationen79.elf
  • Size 640KB
  • SHA256 b599082462a5ddeb516362735d8fdd2d6f7ac9ae557c9d4ab9096b42769a0a97
  • MD5 eed698a968cb26c8284bd8eee481dd8c
  • SHA1 063c2d4e69343cd9a998a9cc2e2505cc4a7c5723
  • SHA512 b8218c158558cfbdeaf1bc9596ef7da8f24958be2ca56d73967704729691a8e58459b250adc4d466865482a7b94aba666c560a3ecce4e66cf4d041e64f9dc8a7
  • SSDEEP 1536:A3Mve6rTD1WcBZ3RcYyknkp3HYBvMOKV/7K5R69kv/kLwQIbgrfYJ9E:A3H6rThPX3RkECzKTCkvcLnrw/E
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral7behavioral8