Extracted

• • Target
    Comprobante de transferencia.JS.js
  • Size 2.5MB
  • SHA256 9e26dc9598297a6b7d5a8e21d3fd2c2a46d20c89d5991ee0e21838f2148fa0ab
  • MD5 17abec9ec1d353d7f722272f01afe79e
  • SHA1 734d726ea5247206251b393dcdf58a5beb6c5796
  • SHA512 58f7ec615b3887b3bac064af95ccc192d95ba651eac862ef00e9af32e04d618cd343bed2fbd5b703f1d067e843a31dc255b9d32eb01ee2d71bc15bc713c7f715
  • SSDEEP 49152:ovqcpC+YgXKxOyf2z0/GJS3qDJpkZyUj9W6RSs+EZA+JvelBbAmb0aa3iwhwrsU:ovqcpC+YgXaOyOzvS4JaZyU06csvASvA
  • TLSH
    T193C57041C20CE973EA2D672CD1379AA00A196D071185EF3F36BCD65F73A1A17235CAE6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionmassloggerpersistencespywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2