Extracted

Extracted

• • Target
    INVOICE_PAYMENT_TT_PDF.js
  • Size 1.6MB
  • SHA256 71829f75b01941def1951cd3aa880d0f5e779cebf6d5737d24fe3a93705a7d22
  • MD5 d4bebcd0938e4803da14961a31b74258
  • SHA1 932903521916e7d0d7ebaa2f716bd13f0b08f02d
  • SHA512 c6314714837fda0587ec6745a72176115fc0094911fa46c060ea708207d1820330c309160f4f93acf182710d9cc2611eb29abf0de16cb368a54cce6e805f62ea
  • SSDEEP 3072:4ApEaRBR4qUXPlpVo/ITC0dUd39Mxeu5KGQB3RN/jRMXnA6ShWlOGfMjKUVYVfQh:oNrQoNuMN6
  • TLSH
    T1EC756BB4B93EF22B543B5F026D51B006FAB91A4226196106606B3F0E5472E16FFC4B7F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasionexecutionmassloggerpersistencespywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2