Extracted

• • Target
    RFQ-CS-2026-1340-PR-1009380228-MQ.msi
  • Size 68KB
  • SHA256 4903fbe3e8ee4bc49035c9fb6e8fd3d258f3daadf237d6b1f8dd3fe41cb4ced9
  • MD5 b11c3ec5c3429224d8ddfcaecbd107b0
  • SHA1 20b6a557c495e76bd4c97d3c84e2efeba160ec1d
  • SHA512 55a3a038eb04ceaee5c349393ac39be5d27375c6620bfa983a264ca616ac589f5b4ef0a21123bf6aa5296c7b9b566dc7367e2ae3cef729509aaeff32b407972f
  • SSDEEP 768:wuOkcPMvEvdZYdVj6LaEH0S1tu2lh+OpfkL56fSQMaN3YW6qCGZMYxC:FcPMv2EdSXlgq46fVxCcb
  • TLSH
    T1BA63AF46F750E232C2820772851FDBE68F65AC4C4FB385137226B34C1F726D496ABAE4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoverymassloggerpersistenceprivilege_escalationransomwarespywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2