Extracted

Extracted

• • Target
    box.dat
  • Size 92KB
  • SHA256 6c69dc95d5f4de41f697da391c441bf8fd148af36ace4a17bffdcb94cbc68404
  • MD5 e767be655aebdcb59e8d3a35bd06231b
  • SHA1 c1c9f1f42ed4e0be47ed045386de6833415e992f
  • SHA512 a0fd9468b264026d3f05f2f3092b886b105a34921a1a655d7647f05c5a0763783dbcc069e515056559c9b464549ac574e5e188505f3738c7205cd440b1294771
  • SSDEEP 1536:xWD477nsc9XXHS/in1cHLy0oLAfiYqlmty87UMR7p6pPkC:s477nsc9X34inqV7ty84MD6pN
  • TLSH
    T1CB93180977E89914EABF8531E67241210B7AFC990926D21D1FD9B8DD2F3BA4084C7BD3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoverymassloggerspywarestealeradwarepersistenceransomware

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2