Extracted

• • Target
    Quotation Request_1162413.7z
  • Size 253KB
  • SHA256 c148c33ac322a79ba86433b236812e3fb728ca61d99e9798b0ee76398d427b10
  • MD5 7728c5fb81efa22a48d980d2198580cf
  • SHA1 71a1119f02a7031451ea49d85284cc4f1d298c3d
  • SHA512 1ca83abea879605bbdcb4443adc28db30b08ae787015d952647918009ffe2eafd5d05f5ac149026a87cac27d536d4141deb6e52891c4d1f6edc63f336d0defb5
  • SSDEEP 6144:VRi5kOr9ki5qFgFEfqg3R04BgC5m13QO+LMU6KULi:Veb7kFgFOd3xeCckS+
  • TLSH
    T1934423FD96B4C5C17C3246EDA13E86B1ABF8CE7B01A82D7F672385C03DA1425519EC94
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionmassloggerpersistencespywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    Quotation Request_1162413.js
  • Size 1.2MB
  • SHA256 a870a7e868f3c8d349c132453f79a4189d4e8d883c230005548191e8548c0967
  • MD5 b83f7fb7d06290ff6c8436ec8bc005c3
  • SHA1 ebf4480f37bb8e797386599ca8b6c3b93228a46e
  • SHA512 140f00b091bc21516333a6e59d518e35fc21cd7e95969536560a2554683369f9a0ff0cf7f90f6288b7bb424d2f775568187cd8cb6f2237c6f99f4e90239a8d37
  • SSDEEP 24576:iptj0mR3Dpd+DCxId+pAVD8czQTIFr8d/3:etvR3Dpd+mEe/3
  • TLSH
    T159452CA039CEB84587257787EA4C58C9CF1F90275AC22AC9B0DE4ED0270754EAAD4D7F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionmassloggerpersistencespywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral3behavioral4