Extracted

Extracted

• • Target
    PO-086809-NO-09797-08-26-PR-09797.js
  • Size 2.8MB
  • SHA256 949457d11dd21a5d329ec259a58613c8767919149f209af66787d3ea4b626316
  • MD5 3a3ff68ebedb0c23829afab6d95597b9
  • SHA1 7312c3d84c34432bdebdb4c4e6f3fad5cecfa9b4
  • SHA512 e310deb2f1c965e95534d50224d7bf2981c5f832f00ce379dfd1955872f54a2a77f766063362efedd462f5da83fb73e68ee625ccbd57b2e1686282ae1ebe3ef3
  • SSDEEP 24576:64mSaXvCoggN5BLz3nVMiJ3CnHdxBm0azl+NvHJ5eQqr9C+8n/K/BdIXMLnrxkTE:VaXy6E90l8/I5guw0
  • TLSH
    T1D4D5310D457EE11A60616C20DB80A4A1637E9D8F8F5F059B164F89FCBB8B12805A7FFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionmassloggerpersistencespywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Indirect Command Execution

    Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

    defense_evasion

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2