Extracted

Extracted

• • Target
    Fedex_G68389B54.js
  • Size 7.6MB
  • SHA256 68aea9911a10b2b3ffc1d5b08ee110390a567de16c7cc4e3c60969752f92741b
  • MD5 5bd2852c61cc919340287e61d657c8f5
  • SHA1 17993d1b85f089d3c49fbd7e569a349509129163
  • SHA512 4c11ad3345e668ddbcaab58bbdc4b02e6d589fb08d0bb1a963bf54adb0e4dc53ced139998ba0a8a6a5487f61dea413ecbe599e0a583bb1a065b6415686a45f86
  • SSDEEP 12288:3FTeRu7lSwE2aooXTyoStfl7XT9O7vyU4ZnoTt3TLIikP6PPQkshmgrwQvZEZg/P:wPC3
  • TLSH
    T16986CF6AADE3323D7133D8F959F28579C8A2E1627B4D416E034A1703DE267C5DA01E2F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutionmassloggerpersistencespywarestealeradwareransomware

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2