Extracted

Extracted

• • Target
    d9e876c0ef78f0d6087d0c41c8d47ebe9fc8137055c9d74bbb7c1fd7fb8e1fdf.exe
  • Size 793KB
  • SHA256 d9e876c0ef78f0d6087d0c41c8d47ebe9fc8137055c9d74bbb7c1fd7fb8e1fdf
  • MD5 0dace8bac4b3d3c0c6140323d660bb12
  • SHA1 35421ee8fe5b43da7467be47a42313ffa3076874
  • SHA512 ff424ebe75d6bb4ab3cedb94c3e2f428939d688e98cbb6b8ba182f665731194000bc5d493a09e0a8bc7ef74a5f5dd65cabc0baf0857194c81ef88fb53ea5c11d
  • SSDEEP 24576:Gj/Og3FbJ/xzRlWdi3JjEYtbZTaiFjBLrvIXX:sPxJFH3NEEbMiFtPm
  • TLSH
    T1680513B567BADB06D2AA8BF00EB1E1B153B86D9EE421D3428FD7DCDB74217245108393
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionmassloggerpersistencespywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2