Extracted

• • Target
    cbe7f1d0836f6bb4434fcd576a8ce8f881b05404b7525b1b227e59e4b1823abf.exe
  • Size 1.5MB
  • SHA256 cbe7f1d0836f6bb4434fcd576a8ce8f881b05404b7525b1b227e59e4b1823abf
  • MD5 c2586fde04a4b9a6a6d30ddff90b4eba
  • SHA1 f543e14756b80815400cef816ce966c2908d11ac
  • SHA512 94b1bf12e669345b791bea8b755a7a8c4fa0745a8a4ac353a634cd4fc2e3b747081fd5c62e6027fb96d1f2a547ef1c0fa17c8a5f0360539e6fc0a9e831d367f9
  • SSDEEP 24576:Jfe5VkiGFZPhtOIbE5APTE6LCTuiJXRsYCuxOZmj/kN9W4W9/:JQFAbEAy+8xHj8w4WR
  • TLSH
    T17475BE6791404436C4D22538E8C692AB5DEABE302F5865C767FC3D387BF92B12C2719E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoverymassloggermodiloaderspywarestealertrojan

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Family: ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • ModiLoader Second Stage

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2