Extracted

Extracted

• • Target
    QTECH20OPPO-6788.JS
  • Size 2.5MB
  • SHA256 72d9baace64a48d8f32cace82283aa580d1044d7ed4ec815e18002eaacf3311d
  • MD5 7deb158c4dd4f75935ab85a9fbe81dac
  • SHA1 324faebe183e57f0e32d33d6bc419ffe83ddca74
  • SHA512 aafd84dd732c7d3064cc738840d035cbc2e21ab388080d29b27be8ca0b4d9b2bae64da79a957f5ce2d95b389792a52a1f7161bfe54cbd2581536d428f3d3410d
  • SSDEEP 49152:r1Kg9563VCl+3c18F90q4Geiy8z8OULLgw+1RskwX5bvgMQ6lXBiCuiySARXEwLV:r1Kg9563VCl+3c18F90q41pOCLq1Rskf
  • TLSH
    T14BC59181E3849172732067AC8636993C990AA01357CEEB373FFDD619366CD176718BE2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionmassloggerspywarestealer

  • Family: MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2