Extracted

Extracted

• • Target
    PAGO.js
  • Size 2.4MB
  • SHA256 14c618dec5ec31c655ae3c518d2af66c6b5e44162b68c20e725f1ab76bf281cd
  • MD5 47af348402ab6750f67c9c14fda0b6ac
  • SHA1 3b90b047e90d59e40ce855a07fcfb3e9cfbaac40
  • SHA512 b8d6ecb574fd28ce5bf69437cd00817fab27820244cd615fe33fe630ff2af704679ee66014726002608e074f6f63b856369656e8ed5606e5b3bf442fa98ff8ec
  • SSDEEP 384:dQt2S1T8ovO31Hmpe9m7VTdc1fVm+YP6ROf8JVivLqbGB6YUc/kE25QhtlxRx7Ih:Ww
  • TLSH
    T177C5128636A4B0CECACA73D14E48F7939B07324D7BE361E93A0327F55D860782945DB6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionmassloggerspywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2