Extracted

• • Target
    rccc123890.js
  • Size 424KB
  • SHA256 bb51a8cff5b401653c7b0ee7cd3be33f8f5a6a7f9d9c9fe8f52c57f6edb4eaa6
  • MD5 62f8fa82a04e7da264f11c22ba077083
  • SHA1 d5cc1fdc41b344118fd2896fc4624166f1759b5c
  • SHA512 b9507248d6d1293057ec251e694fe83aea4431b4e010275795959147acc72f999c6998840db5af00bfe5260ca1688d382d092bc9d67c988300dbc76988acc192
  • SSDEEP 3072:TTowOhYZHmf/1GcW9ZAGusQo9pXm+AMko5oyXXLWOQvecsmTG3NSGtvyRT6XGgHU:q
  • TLSH
    T19D942C1277FA0A08F2B29F496A3B44650E7B7D55AC3CE21C169CA01D8BF3A44C865F77
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executiondiscoverymassloggerspywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2