Extracted

• • Target
    Recibo de pago.JS.js
  • Size 2.5MB
  • SHA256 c26311f71197a5b1dbdd7eb574c716f00e7885096a9b275f4b77e8a09a6bbcfe
  • MD5 703c588f8c3987dcf77459770998039f
  • SHA1 32855b6e9f852dfb5464305e7d362182f17a63a5
  • SHA512 0814fd2812d5ee884ce4f595df663352c10701cad97aea90403d986b47f69e41077a02bb0e4ddadabc5ee928dbaacac2b8e4198f58ef081aed463c578eaf239b
  • SSDEEP 49152:dADNOJK400rKkOgZs6Whq2nJDSR305GExzwVVdLNxSbuCC2RYo+9/moBQyqH8OSD:dADNOJK90rKkLZs6Whq2nJDSR305GEZe
  • TLSH
    T16EC54E51D34CE873EA2D5B2CD437AA100A1928075185EB3F35BCD68FB3A2B17275D9E2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionmassloggerpersistencespywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2