Extracted

Extracted

• • Target
    RFQ#6000222713ADM.js
  • Size 7.7MB
  • SHA256 76771c0cfe10218fc1e8ba4ad2adfde996e1f5fd4b9987294da57e5b2a496e50
  • MD5 0fde1288ef288731aef0855b08be049a
  • SHA1 827749fd69bc733ab31a00d2376f5fcdcf58968d
  • SHA512 77b50c3ddb413b155291fc237aafe8043eb20ad12b4c6901d4f36f516be019146060f17fc5ae43aa13bafe0dcc506154e6e61676e229aee6a44bff1354807a2e
  • SSDEEP 3072:m8MLTZMDDcC2nyrQEyRd6osa/YhAYkb+SE88HQwzounh2w4mix8EoRsrRAc2xJZ1:E44C2GuR4kgC96RReKBsjoDWuinC
  • TLSH
    T1A8863734C5ACE41AF6FAF4FA5F865300DF318ED45A2CE40A37C6930EA409959D9EB24D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasionexecutionmassloggerpersistencespywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1behavioral2