Extracted

• • Target
    DHL11-05-2020.exe
  • Size 1.1MB
  • SHA256 4b675daa6c54e06962ef1162fd7fe105fe9e76193626ec451dda29081cab3582
  • MD5 f786e547403c0dff7eda565cb5cb7c1b
  • SHA1 2ecc1ac4325fd994336904c3d8126ec91b93efda
  • SHA512 c129736dfead883d577980b4ce55ee107d28d1c12d94b42be6a2f5f36f862ce6ec3810b4430379c0b165940a0909f8e6a968b839314f3bc5f2e5530719045c8b
  • MD5 SHA1 SHA512

  Score

  10^/10

  massloggerspywarestealerupx

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • MassLogger log file

    Detects a log file produced by MassLogger.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2