Extracted

• • Target
    cotización.vbs
  • Size 33.6MB
  • SHA256 885f4a8f70898d4c3d90fe723d6f2901c886b3f5b1eab15f11cbb18fd46aaafc
  • MD5 7f18095ead0b01a31ecebc6e3c542008
  • SHA1 4f8e7a59cac328bd0590504d9abe4baf29dcc4ad
  • SHA512 cbeaa376195914e60de4bfc1743fc347e1939165f655d8236fe4016be7e5ace100b54a5ad18e26f20c87e6f9ba607128f0f7c383c5d2b6452c5019f5e3b5cf1b
  • SSDEEP 384:68UN6KL0UHV0D2bsdSffBG0BuHg1wp0l1Jojpd5OwMuVOGnYNRoLGZ//0BjHqH96:wG
  • TLSH
    T111775FAACD85F06910B424A0E3DA7C631BE2B8E69C35F9D97D67716B846CCB38C541C3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionmassloggerpersistencespywarestealercollection

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2