Overview

overview

10

Static

static

SWIT BAN.EXE

windows7_x64

10

SWIT BAN.EXE

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SWIT BAN.EXE

  • Size

    1.3MB

  • Sample

    200710-pjs8l516r2

  • MD5

    1aa318b5c4ad4d54c98e55d54cda70b0

  • SHA1

    b5bc6828d418389f09c6a0543545075f2cd1b0ae

  • SHA256

    f316c85b920176e192357ff4b735f6d1b99fd7af2f23e24b80e3aef4fd2522ba

  • SHA512

    60c2523f341df94bd4be1a38c6d0c3c49d59f3730da7ba3d0d7c1cdb02944f460e24176d06f894b232cace9e61b0a879d8a9fa9f0d237e3ea6475f71c4ed1fd0

Score
10/10
massloggerransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\C8A579F880\Log.txt

Family

masslogger

Ransom Note
################################################################# MassLogger v1.3.4.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.13 Location: United States OS: Microsoft Windows 7 Professional 64bit CPU: Persocon Processor 2.5+ GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 7/10/2020 7:31:09 AM MassLogger Started: 7/10/2020 7:31:05 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\SWIT BAN.EXE MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Targets

    • Target

      SWIT BAN.EXE

    • Size

      1.3MB

    • MD5

      1aa318b5c4ad4d54c98e55d54cda70b0

    • SHA1

      b5bc6828d418389f09c6a0543545075f2cd1b0ae

    • SHA256

      f316c85b920176e192357ff4b735f6d1b99fd7af2f23e24b80e3aef4fd2522ba

    • SHA512

      60c2523f341df94bd4be1a38c6d0c3c49d59f3730da7ba3d0d7c1cdb02944f460e24176d06f894b232cace9e61b0a879d8a9fa9f0d237e3ea6475f71c4ed1fd0

    Score
    10/10
    ransomwarestealerspywaremasslogger

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger log file

      Detects a log file produced by MassLogger.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks