Extracted

• • Target
    New-Order-No-2333.cmd
  • Size 3.8MB
  • SHA256 e42a6e9733399c98085c240615fa61e26e183485c65c50bb8dc93832800a5ba4
  • MD5 f476d3d94768045e0efd8cef39d537a4
  • SHA1 f4d2897b0a875c1b4a07e2eb95aedf1cec1acf0c
  • SHA512 d0b0f7971bb5922832d94519d1efa1a911559c1a46b056ddc8ffd18cc6fa838c41ae4fb99f876f3bcbf67311e6844353758e55f5d69579229f7860d5dbe345bf
  • SSDEEP 24576:o2ADQ8uMB8nTnk73Y7tI5yhRKVv/wh2WVhl8wrXX6NYpLiye8xV0eeVpVdSzx:PM2nbTKd/w4O5X6NYpLy8xCe0p4
  • TLSH
    T15F165DD23D1720E4938857EEF315AF9F37585FC4B960BE8EA7E8368C6A1225E4D19070
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionmassloggerspywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Deobfuscate/Decode Files or Information

    Payload decoded via CertUtil.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2