Extracted

• • Target
    INQIRY 2600410.js
  • Size 709KB
  • SHA256 bc3a52acf795256a9b27a177665774b425105735f892878bc0bc5508bf38dc49
  • MD5 d442922f679d5bcaca26e6e49ab3af00
  • SHA1 1e36afa9ca599198464c31b151e886ad12528072
  • SHA512 1b8bc1bc64f590039aaa82847240b8aa1010d3ded1726ede06d03d928e266eb3feef41d318d77135c9bbb7d78d399f0129a70691eb6c0bf1424c4e26e49c74d9
  • SSDEEP 12288:UFM3d5rIOaN5oszBfC0zZf7ICifCIDIH7jCmjY6myq:+M3dpz6oszBfC0sBfCxHXB6j
  • TLSH
    T135F423A9E7F229F426FC647D72CB3D1411C22E8440318FEEA5960EE719F67026B1B65C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionmassloggerspywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2