Extracted

• • Target
    TALEP SAE0306.hta
  • Size 2.9MB
  • SHA256 653a9fe4dc002736cd9eedafe4345d3cace7fa5ab2926fa8bbab15795834c9c7
  • MD5 d65b291e3483b0b78387c805a68298fe
  • SHA1 357605ba55c486f4d6d208055382b7daf74fb3bf
  • SHA512 6b9c31444248b31e603616cf3df51e857d429117b16c6304668ec92f423be2545b4f4fd8808cb1640938043c4aa6397d85a6b53c2f48cf496fa992d9d92eee51
  • SSDEEP 384:E88888888888888888888888888888888888888888888888888888888888888e:0+ZV
  • TLSH
    T1C9E59E6D2B7E0026B0D63510DFF7A9F7BED0E657287A4C6CBD6D29E047B80016639DA0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionmassloggerspywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2