Extracted

Extracted

• • Target
    RFQ-09797-MQ0958-06-26-HYU-09687.js
  • Size 8.6MB
  • SHA256 050500533700664d4dcf7439ae3367716abf404f390d4c94e95e3b00fa7f8fc4
  • MD5 13f1ecdb1c9e9b773192240fcb62400e
  • SHA1 b8b7ee49876aa5321b23d23a3832b83db1751026
  • SHA512 9419f53f7d3491de47ff661d343f28ff027a5477d082a0f4765cfade05db7e58a40ee13edb1566f9cbb7fa9df7c2798743da8c226264f008a4220facbaf752d1
  • SSDEEP 6144:SWXfOdiR/jl+LLeCH+PJ5LdemfllKMtXJQm33l:bfOdul+OTeullKKXJQO1
  • TLSH
    T1BC962A6CFBAF4329B776D642B0C56827AD1F124117DB942C12B67ECE0727352E9B280D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasionexecutionmassloggerpersistencespywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1behavioral2