Extracted

Extracted

• • Target
    Purchase Order 0138801.JS.js
  • Size 4.4MB
  • SHA256 846f554b4be26787b8a4ed2642526de9c04631e66180b00e5cac5601a8731afc
  • MD5 7c6b112d0371e388425cc2700b122bb7
  • SHA1 5205070f78d1434d820cc003cbf803022bc32b8c
  • SHA512 33e17f7fa8f4d4683552e48832e0b9a40c6a19599c8c7a6032b095b55c1ed84c8f58b1d442af5e42e4d5d9be23ecd50c4f557b912af1ec88cfafeb4cd761e9ae
  • SSDEEP 98304:N2MmDuB6YjIhqG9836q6DnU6aXWI7wgp4+HS2ILdhzFWAHMaBEwYU9NF2:NQDuDi93aXWEXfI8EzJNF2
  • TLSH
    T172268E483B54B3434069D71A65857984C7288B0BA148DF233EBE78D9DFBEE06A2C7774
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionmassloggerspywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2