Extracted

Extracted

• • Target
    INV.E08_R OFFER_E09_R.JS
  • Size 2.5MB
  • SHA256 93c0f643fbe3a21f8ba05a2d9e48c259a66a0f49e9bd79b409fa342f4bfdae46
  • MD5 900df48d74f8e3642e580d373da3fa0f
  • SHA1 7577a0e465d3b4c8e1052305209414543367ce74
  • SHA512 415c6e3b3b1d007553c329e62680f26f945f22c976b29d556cfb9d96c9af805a9b12725ba858e9171f506acf95e6de2b9c6ab6c9be583c5ea4e4db19dfcbfe6a
  • SSDEEP 49152:eGWsfvYxZT2AuMKMmFhx3IXnC+HzHgva7X+fWTkZE+cfQuU3GgGN6XiX:eGWsfvYxZSAuMKMmFhx3IXC+THHqfWT7
  • TLSH
    T104C56DB04145E272A178C51E8D0B7BF58EE5BF0B75D0EA72767C7AADAB88F103388544
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionmassloggerspywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2