Extracted

• • Target
    SIP 103.hta
  • Size 2.4MB
  • SHA256 74c1bf2fa35117d4dded64cda9e44617dc441d4dff3315c986604ff329b3138a
  • MD5 1868b81a612192bd877cfb062d6a9a6d
  • SHA1 2837fe576fa7bbb3f1b6710b6001a5bd69860ebc
  • SHA512 364ba6b66c47993b475d2165026083611ec84205ad43c6fef30a62eb0a6c62255f35445655ec7296e286c3d3a688b2d63dfe956eb322798056247ae6a6c51128
  • SSDEEP 768:kzSzSzSzSzSzSzSzSzSzSzSzSzSzSzSzSzSzSzSzSzSzSzSzSzSzSzSzSzSzSzSl:4R2
  • TLSH
    T104B512428BB30A613837FF1899F331DAFDAC6459BE3445EF692946E9C204173F4D8968
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutioncollectionmassloggerspywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2