Extracted

Extracted

• • Target
    tmpjvwoc5ur
  • Size 8.5MB
  • SHA256 85bebb4da660f33be5aefd120cf7e715f76d22d87fc9334413f0061f1a238fa5
  • MD5 abfd77f13c92d8748e37558ecb3db828
  • SHA1 15c2d2b96830c529d0479061e99a244a430da360
  • SHA512 e9dcdf42a9690c5155485e60a1af77b2db1556dc9226fee9b415b292a59f60e10d37131329793bb615ee1702be554f663b2d7309249b9137f7e45df165dbc14f
  • SSDEEP 3072:jp8Gqo2IYanVsM+nrT6W22q13CEB78GDGRnaOyyAic2A/f24tIDLlFUCpvnXFRH/:ejHNg8u68p1jC
  • TLSH
    T1CE961B2DBBEE015C9C26D386EAF151E4C5ACB92203DF651F80765ECE5312386D93226F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasionexecutionmassloggerpersistencespywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1behavioral2behavioral3