Extracted

• • Target
    9db47d46c9411cef28cb767455f523c0ed8bfdb9cb6a087b665fdab87d7741eb.exe
  • Size 938KB
  • SHA256 9db47d46c9411cef28cb767455f523c0ed8bfdb9cb6a087b665fdab87d7741eb
  • MD5 c5107d93ada11e139036e9c03806a13a
  • SHA1 4d8711851738c81c37d20accd6965ad7fe26871d
  • SHA512 b68a8efe2d08d2b26089c6c138f5df7d482918b0117bce9ee4a4bdbda379d44595a25195949abfa779942f8b2d65e55d2afda062244383360f826a25dd4a72dd
  • SSDEEP 24576:0c1h/IuvcNMPtMnsIEOaODSWzdrKgap3aQR+io:0cqiPtMndeODZdrKgG3aQRa
  • TLSH
    T1D415CE482257DB27D4557AB4C933E3F40A646E95E910E23F8EEA7EBB7F35E305840182
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionmassloggerpersistencespywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2