Extracted

Extracted

• • Target
    rok123.vbs
  • Size 271KB
  • SHA256 fa4c85398b343abb47d85ac173762974125bf375059ffa58d5cbc982059aa626
  • MD5 560bf95fc5a4b95beb699c104ccdfbb4
  • SHA1 0411a632bb1b288b4498664468325da85d6cf9c0
  • SHA512 30b4d37a48d4b14d7b0c124ad575d347ad3204f0dddeff20f4a1f97cb14fd38c965ca716c4052df2046de0f87ef712dd1ba922cd574b73768d606a684771f7d4
  • SSDEEP 384:bRtodBNketbpWExCpIiExeOXvm5uOkVStmy5mWONwuXWOBObrWOBO6CwyPpavIRG:iI
  • TLSH
    T1474455BE30AD41E4F97CB859F702D654061CE923C51DEAD6A142FB64893D2AC231B1FB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executioncollectiondiscoverymassloggerspywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2