Extracted

• • Target
    Orden de compra.js
  • Size 2.0MB
  • SHA256 5b5b23977a85385836d159adf908f6de353ca69cfc390d1fb45247551afa6a01
  • MD5 39e2c1d8cbcdbfbc18bd9a42ab184fcd
  • SHA1 6a7f6ab059ae637d7216286e815238b9e2319983
  • SHA512 03ff1953ca9295bbc27a241fa7f3b31de95eefe98a386126b2814a01db3a6123c1b9fbefb4a6209f6eac88376cb371de76ffdf42e377cacd1784a1f652b9144b
  • SSDEEP 12288:e9dcwgsBdgQ0N580j7HLbJl7m8ztLkJvWudDcFF32KAx0x9V0z077z:e9dc5r8y7
  • TLSH
    T1F0A55B38ABE0475E6235C91157D9314AD40FB7837BEBD89446B60ECD035308ABEBB25E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasionexecutionmassloggerpersistencespywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2