Extracted

• • Target
    RFQ #0426-145282-BORSIG.JS
  • Size 2.7MB
  • SHA256 733c7ea9314a36484677becadd697535ef8685911717ac52f3f77ab242cc8e7f
  • MD5 e78007cac90ce591cb6160834bbabf40
  • SHA1 69842a0df23b53c52f4b4281eb34d7511b5e46a0
  • SHA512 41f1d91a75f6be53dbf55e4f606c2c381bcf1249becd17dbc7795abdbc8802e426ddc9c06d86e6ee0a5a265113f719ea6de1012d6b1003be4b295221cc1d142f
  • SSDEEP 49152:k/JtOaz7PSncoe88wi8GizzEgwqmRcFqAg9KgzWjYeNgGhLneQ:k/JUaz7PSn5e88wi00Rvx9bzYTTheQ
  • TLSH
    T146D507505758A0727328E76CD236EE78540EA00325EACF1D356ED224B96DE4BA74CBF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionmassloggerspywarestealeradwarepersistenceransomware

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2