Extracted

Extracted

• • Target
    PO-097909-0969-08-2026-QTN200-09768.js
  • Size 823KB
  • SHA256 c9efef37449a114244510810c8c5d6feb25d24d163fb16aab8ea2568af02171d
  • MD5 bba6782bac30093374f97883867e0b17
  • SHA1 ce1768ddbfbbe9bdc3a495054faf851e5fda3071
  • SHA512 82eb1ecb08c6eba353dac7184c42cff87dd20579f7156b16a48dbbb009df11a1384ef333016632f9c7c975c2257bb39a88a2a8fb34b8ca777aed32b72e0a003a
  • SSDEEP 12288:yACoVfus7Kt8W04e0wqR4pJH3BDvTdPFNtal/9W8H7ApO/+pfVBKmUVSZzLPM1Ux:iSWN1WJH3BD89W8HcAm5U0ZFdBJ
  • TLSH
    T13505D0A34A093FF547B009DE41293557D2D2C6131D3DB27D3B6229CEBE2E2424D6EB86
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionmassloggerpersistencespywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2