Extracted

Extracted

• • Target
    RFQ#CIQ-88734-737.js
  • Size 1.7MB
  • SHA256 4f88fe008499703f828a96ea628d4daa58c4cfc6999390ce7777cca5a0ae78da
  • MD5 f2448f94a9be285dd617c8ff30d761ed
  • SHA1 dd232d01dc6e5d041bb7fcd2356bd4e41cd21ff1
  • SHA512 92d1357ceca66fe4c2d0932cb01b39a0e50e49e6b3be537d159f7da4cc191c2e72bdc0d049551912602bb6b538cfe505323dcc8421209487849ad3674f0dcb5c
  • SSDEEP 12288:KBgOJRCc8KkbTAdjA3CuqKV2MGwAe/+4LcMRsSZp3VSGLhi31hN:Cr2fXFoN
  • TLSH
    T133859558F6FB1643B632ED0E5668851D9D3932D32F2EEE84524612448A136C9ECEF70F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutionmassloggerpersistencespywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2