masslogger

General

Target

B3gkHhPlWv3DOsB.exe
Size

845KB
Sample

200616-mwqqwx9a4a
MD5

35a5963bfb1fa8b5e3851378959ac522
SHA1

b1c035b8221c06e14311eda738df7e28a6559514
SHA256

77b7fa89c446b127b0c1d8ad0c5dc5fb57c8121dd3c40a67b77e5c0a35d75114
SHA512

851bd78e047d34a27f532e808bbe6e27cc9b7e09a39bd26ed69b121f9b377a85a381e50f73d8b1775987d7582300b963cf7be119e9cb7334d490d21dacdddd80

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\E2C1E8F1FA\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.7.1 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States Windows OS: Microsoft Windows 7 Professional 64bit Windows Serial Key: HYF8J-CVRMY-CM74G-RPHKF-PW487 CPU: Persocon Processor 2.5+ GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 6/16/2020 8:52:55 PM MassLogger Started: 6/16/2020 8:52:49 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\B3gkHhPlWv3DOsB.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Targets

- Target
  
  B3gkHhPlWv3DOsB.exe
- Size
  
  845KB
- MD5
  
  35a5963bfb1fa8b5e3851378959ac522
- SHA1
  
  b1c035b8221c06e14311eda738df7e28a6559514
- SHA256
  
  77b7fa89c446b127b0c1d8ad0c5dc5fb57c8121dd3c40a67b77e5c0a35d75114
- SHA512
  
  851bd78e047d34a27f532e808bbe6e27cc9b7e09a39bd26ed69b121f9b377a85a381e50f73d8b1775987d7582300b963cf7be119e9cb7334d490d21dacdddd80
Score

10^/10

ransomware spyware stealer masslogger
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger log file
  Detects a log file produced by MassLogger.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2