General
-
Target
Company Info.exe
-
Size
1.0MB
-
Sample
200707-12ptgbzsca
-
MD5
49c568fb7de5bb77140ab3b40e54fdff
-
SHA1
6d74dbf23a857e11d9a30a28e2ebe7dc3b74735a
-
SHA256
77f7dd01dbc1cfa243fc8301937058094b3c02ffb3f18e8dd7b3221723705049
-
SHA512
de918d8654df77256b5a7036c8c5e969605c2744e160b58cb5bd86e0abcf691c9f55bff43299b3149152ce5c02191c9b8e56b4254dad7e9dea2c7dc7b41489de
Static task
static1
Behavioral task
behavioral1
Sample
Company Info.exe
Resource
win7
Behavioral task
behavioral2
Sample
Company Info.exe
Resource
win10
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\E2C1E8F1FA\Log.txt
masslogger
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
Dmacdavid
Targets
-
-
Target
Company Info.exe
-
Size
1.0MB
-
MD5
49c568fb7de5bb77140ab3b40e54fdff
-
SHA1
6d74dbf23a857e11d9a30a28e2ebe7dc3b74735a
-
SHA256
77f7dd01dbc1cfa243fc8301937058094b3c02ffb3f18e8dd7b3221723705049
-
SHA512
de918d8654df77256b5a7036c8c5e969605c2744e160b58cb5bd86e0abcf691c9f55bff43299b3149152ce5c02191c9b8e56b4254dad7e9dea2c7dc7b41489de
Score10/10-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger log file
Detects a log file produced by MassLogger.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-