Extracted

• • Target
    3522fbd2c52c010c282e7515153c31cc354b110357774f8ec135764060ba63c1.exe
  • Size 832KB
  • SHA256 3522fbd2c52c010c282e7515153c31cc354b110357774f8ec135764060ba63c1
  • MD5 00fff46f71b1ebd08d593b3fee92f4b5
  • SHA1 b26c29aab59c048cd85125bd5c23213b17150149
  • SHA512 b2cfa9fb55a749ade94229a1a35af2ebd37a9e6bc95a9da09a7a23e68f832df2de3814667c87a0624d40831d3244b498f2cab25ecf760a27014426c35db2895c
  • SSDEEP 12288:1/AKvOZt7o85rsbrT8/vjEHAMKKvyWZdBNuCMgyDJsn/aZMljR0lE/V5Je0sZptS:SoO1rGrTkvA/CTJA7jH5toptKigDB
  • TLSH
    T18905BE89C1D4D2AAF06A4174F56707F44303ADEBD67C8A7B245C3C247AB934E907AE1B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryevasionexecutionmassloggerspywarestealertrojan

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Disables RegEdit via registry modification

    defense_evasion

  • Accesses Microsoft Outlook profiles

    collection

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2