Extracted

Extracted

• • Target
    10fbfe4d9e0f9eed31caeb1a0fa2605ef1b1c36da477dceea75d5610541ad728.exe
  • Size 631KB
  • SHA256 10fbfe4d9e0f9eed31caeb1a0fa2605ef1b1c36da477dceea75d5610541ad728
  • MD5 644eea3abd890fc1b3f5b0426f077af2
  • SHA1 70f5af7e439c8285311c8211f693db606f95c3db
  • SHA512 326d728d2c385fe2177882ff248aad45ba1982808485bc3ba0fd8bc68f3697c2e740db0ceb7891430f9e9803b9195478a9d1c89642e86443279bd28f61d7e79a
  • SSDEEP 12288:Hg/M8gTPxmEP6hIdL2Wy9A+5EQ2DIiPDMLhrQFeP+:HgE8g1zPw2L2WqAGE3/PuhrkC
  • TLSH
    T1C4D468076A5DDAD2F4BE06B4D862A3F432606DD9E821C34B5DF7BE8BFA31240541634E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionmassloggerspywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2