Extracted

• • Target
    mby77094.pdf.hta
  • Size 2.2MB
  • SHA256 ca62e31191f9abcbf923e723d363b1841ac7b20a6ca9da9345e7d4922ecb8fe3
  • MD5 cbdce5549da00366805b596bb5c9ac64
  • SHA1 302b13eb2664cadc40f48e76c6b65f10017ab92d
  • SHA512 f716f09257bf452e5a89f1aa385813c5e23398e8e058e9d0a34167568f24db7451e3108418915c077135bde6856f499a0e43e050ca5acb7e09cb2f1f21dfe2ae
  • SSDEEP 192:Up+IVa1386RrTGg+Qxk56q6GJsFsnGQGKi8:U3VaN8yrTGg+QkPJsslG98
  • TLSH
    T19CB58F30D79BD0C03C82C65AC1DCC9E8EFC54B6696FF352AB4DC3EE994D898454986B2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionmassloggerspywarestealercollection

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2