Overview

overview

10

Static

static

Company Info.exe

windows7_x64

10

Company Info.exe

windows10_x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Company Info.exe

  • Size

    1.0MB

  • Sample

    200707-12ptgbzsca

  • MD5

    49c568fb7de5bb77140ab3b40e54fdff

  • SHA1

    6d74dbf23a857e11d9a30a28e2ebe7dc3b74735a

  • SHA256

    77f7dd01dbc1cfa243fc8301937058094b3c02ffb3f18e8dd7b3221723705049

  • SHA512

    de918d8654df77256b5a7036c8c5e969605c2744e160b58cb5bd86e0abcf691c9f55bff43299b3149152ce5c02191c9b8e56b4254dad7e9dea2c7dc7b41489de

Score
10/10
massloggerransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\E2C1E8F1FA\Log.txt

Family

masslogger

Ransom Note
################################################################# MassLogger v1.3.3.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States OS: Microsoft Windows 7 Professional 64bit CPU: Persocon Processor 2.5+ GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 7/7/2020 9:01:38 AM MassLogger Started: 7/7/2020 9:01:32 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\Company Info.exe As Administrator: True

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Dmacdavid

Targets

    • Target

      Company Info.exe

    • Size

      1.0MB

    • MD5

      49c568fb7de5bb77140ab3b40e54fdff

    • SHA1

      6d74dbf23a857e11d9a30a28e2ebe7dc3b74735a

    • SHA256

      77f7dd01dbc1cfa243fc8301937058094b3c02ffb3f18e8dd7b3221723705049

    • SHA512

      de918d8654df77256b5a7036c8c5e969605c2744e160b58cb5bd86e0abcf691c9f55bff43299b3149152ce5c02191c9b8e56b4254dad7e9dea2c7dc7b41489de

    Score
    10/10
    ransomwarespywarestealermasslogger

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger log file

      Detects a log file produced by MassLogger.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks