Extracted

Extracted

• • Target
    RECIBO DE PAGO.js
  • Size 1008KB
  • SHA256 317d93f4c82ab3761f02d8ff2380bd07adcf23f24ba6a88ac63d281069c2ba59
  • MD5 4e1de92c1c568e49bf75049f2547873d
  • SHA1 39ff459017e872647043004a2906bddc179768ee
  • SHA512 83ad9ec23a39baa2fe17628f4e1c9ba8f7a8ea40881d2abfc07620cc10c97ae00e7a4a19a3a8be08a44f7dc25a25b24b8242d134fc7207380e50224d371c1dc9
  • SSDEEP 6144:uX6Tis73LM4pm/HTTWFuQsX6r9EKxYtasXsqkjelO7B5lYqAmcQeFsM:uq1bM4AnUu5ta+kClOfZWQFM
  • TLSH
    T19D25D9DF7BF73A8C2408B71A89FDAD8D1442CC910462A07AAFB417DAC51D6416F8D7A3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionmassloggerpersistencespywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Indirect Command Execution

    Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

    defense_evasion

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2