Extracted

• • Target
    orden de compra..JS.js
  • Size 5.7MB
  • SHA256 ed6166d40bfb64e02f83447d5cc38b10170ff68839d64f21e6292c33446af706
  • MD5 97c39f9988d1891d725e8cb91c0119ab
  • SHA1 2d7350badfeb6d9b7e4b039e5d4b448d87df3ba2
  • SHA512 a539cf969b51a3a5a662d6da12c5adf8ffda41484e8cb87bf849a38f64b01deab69b1f2a323cdab6710e8820e1b6141c163a84da1082854a9414d7e8622457b6
  • SSDEEP 98304:+n05KeqgyKjC4wcKdR2AbjcCNxAT6CyVwQtIcncSLN4vnpT6CyVwQtIcncSLN4vC:G5btzATjHCnc3pTjHCnc305btzx
  • TLSH
    T1E256C6B882445EB679AC271CC2357B008579B58B1B64EB9F3978237737B17025ACECE1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionmassloggerpersistencespywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2