Extracted

• • Target
    110962df85578b3a3d46ff96d15966c0365f885f087ef21928e605fa7aa164cb.exe
  • Size 562KB
  • SHA256 110962df85578b3a3d46ff96d15966c0365f885f087ef21928e605fa7aa164cb
  • MD5 3c553e107e38374fea97f8490b6b9542
  • SHA1 2a81e2bf99e920e28e3f8295e0ca02ff3db05f48
  • SHA512 caf619b3832202accf52c60377ea97646f59d949a6ec59f6eabf5e3f59f9fa487e87f3e6f9357ce1e85b0fb77ea91243099afcc90bd3df715d318e43f30160ff
  • SSDEEP 12288:2cjzKHoV/vyXJkACDx/bYWjwUvZTVUBZnTpaoSd:9+HM/65kACy/UB2r8d
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  massloggercollectiondiscoveryexecutionspywarestealer

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger

  • Masslogger family

    masslogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1