Extracted

Extracted

• • Target
    Purchase Order 93309.JS
  • Size 2.6MB
  • SHA256 e6a9e550e7a2d09a6b71eb200c21e6446c871bc0e25874e66fdbf5eb0bddfead
  • MD5 471cf3fbb327e8d860585335405fe47e
  • SHA1 50995b05e134679de54c0e811d55ae454facdaae
  • SHA512 b792429cfb617966e7a0b9d618bbe83ae145c81f908868110dc7bd65d015d593094989fb2ef07b9aa3aee4230171f4890849c46f2dd5c596499e0cfaf325f44f
  • SSDEEP 49152:LcCFcpjYGjdOnyM/lYczKMChUMq28wj3iq77d+YpV5zAqTjsqf0nlaEXWaqyvK:LcC6pjYGjdOnyMdYmChF18wj3iq1+YpP
  • TLSH
    T1E3D57D3C806FE16A64690517802C2E9107D1B40F3FE4A9F1B6DAFD9A9774F053ACB786
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionmassloggerspywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2