Extracted

Extracted

• • Target
    New Order - RS-6.JS.js
  • Size 3.4MB
  • SHA256 ac74ebb7e8bb4beb09c00d8605c315e682a9824d8333851c41bed8ffde74dcae
  • MD5 2ba1f7cf4e6fe38cf6c9bad82bc405a9
  • SHA1 3ba2d9b36ea7ed9f1933f12681e70f65604cf916
  • SHA512 7ee60701ccd8dba8970d0f9b45fbbe8b37638a58e3130e1775abc72e99a6a76d153f0ee70a395bd4371a14d1289a740abfa3445c6accc85b71bd7a782863d888
  • SSDEEP 98304:QX0sebV26OcosAmb7skkGtWYetHvl9hEIN3no8m8zwaS6eHR2ldd8ri7ySQD:QkHh7Rm1bwINdzFsIIiedD
  • TLSH
    T19CF59D4501C7E216B47FC6258819EFEA0E25454B2A40FD3A3B785B9FA63BF273E4D250
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionmassloggerpersistencespywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2