Extracted

Extracted

• • Target
    RFQ-26EOGT1326.js
  • Size 5.3MB
  • SHA256 9e8425815626d2ce26bdc913dea0d5fc1f400fa3312efb997d905505dbd5aea1
  • MD5 a5fb341ea5137f2c1ce7997b76d52b8f
  • SHA1 20c4315672a41d0dd3e0e5401022684b9d2e3fb2
  • SHA512 d515e7fff049e8a87eb5e4f9127dbbc2a5b24c84ad538675c81bca748c215fb17084af54808606631b5560bb4af1d3eaf58905b5dedd25085abe32c794b45887
  • SSDEEP 3072:qYf2bHDETVAiM9kAEE/Kh3Z6pC9q+JDcIjh1KoOccHtLf8nsZqe4UEcS1TApbJf1:G
  • TLSH
    T19646B97CDC28827EC1B3D22DCEC78A07F8564826361DF94AA0D3731B9163293B5E656D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionmassloggerpersistencespywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2