Extracted

• • Target
    SAMPLE REQUEST.vbs
  • Size 1.6MB
  • SHA256 30be482c892d69084fb440ea0603a76693b92e58fdb4e256a67ca5356d2697cf
  • MD5 0efabce828cb80606a36f8467decbaf9
  • SHA1 037140e1ad382cfa2065b5b9a031e1edcdd04ee6
  • SHA512 159569af29b13292cf23a0056faa0c5270a5ca2255be1eca61cd503e9e737089b6043456c6fd0233a523fb4cc94288a73df174ef54362eff18c166b006b84393
  • SSDEEP 24576:JX6AgnH43lFUPGzyqOlbXRy9UJR+SSaRR1:JX6XklTAT/cDK
  • TLSH
    T125754D34ADFA402EB173EE558BD4B5A7E95FB673370E981D1082038A4713982EDD163E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionmassloggerpersistencespywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Indirect Command Execution

    Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

    defense_evasion

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2