Extracted

• • Target
    Documents_and _Order_specification_LDrawing_xlxs.scr
  • Size 632KB
  • SHA256 fe8bebd53ed32bcbace729dc0913f3cfbaf0cdd958a3d5f95402bec0586cfae4
  • MD5 6a70499c014a4cff3e3054b32158be78
  • SHA1 101d75e8af3ca6d5d7e03800a0f6638f03c245ad
  • SHA512 a7fab9814390292eaeeb8cbe95ffb3862c507cdbcc1ffb0d31287b1fd5cfd0d6d7e9841f29a1c60c8ad32c832adf47fbf89f3e9ecf07bb80f1caa969b55f0cee
  • SSDEEP 12288:o3NzcodHKVj5kb3ru8Uxw5E5zEC+iG3HiDRXvgLt3Zz9qVg:kNzTHu2b3d5EFkr3HiOzYe
  • TLSH
    T155D4E076A74CDCCDE045397148B5D23100AA5E8AE46BC21BFDD93D97B4F3282259AE07
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionmassloggerpersistencespywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2