Extracted

Extracted

• • Target
    ĐƠN HÀNG A 2500533.JS.js
  • Size 3.1MB
  • SHA256 3c9421455f0eedb39b906dd93548d4501cdb3885e958ed4c420006f3a082e90e
  • MD5 159e48379affd3aad18639e049208b3d
  • SHA1 6c5c4c9f3457447964131c80db288c440a0397be
  • SHA512 4e360ddd7fe4e03c072de896ee8c60c71653ff130a6f9a8fa425b6e0d439c401823f4bbcac02d40df969ac0b8c6f5ae9d88be49dd077cb8ea03ea1381a9d02f6
  • SSDEEP 98304:QgqlRa6rGKnyoxebxWxPDkSDxwPIeRckJTs5sR3Wd8iQrgKu33C:QBHKntLZcuTLGbDi
  • TLSH
    T196E5E36E164C86C19C28529FCF3BFAB1C51168277750B8E176AC7959FB9CE81333A702
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionmassloggerspywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2