Overview

overview

10

Static

static

5f248cb480...a8.exe

windows7_x64

10

5f248cb480...a8.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5f248cb4805098190906c9fd9dd9caa8.exe

  • Size

    1.1MB

  • Sample

    200713-e3djs6lyqa

  • MD5

    5f248cb4805098190906c9fd9dd9caa8

  • SHA1

    49d5b6670b587a6f1c4d94f8aa6e0af7c0c9c0f6

  • SHA256

    eda87d9c8cca853fe6620d6a246f94a8ee739c7278fb4c68c46374b598cdb842

  • SHA512

    2444545aeaf33f30318fc6b795e5fa7eaf7258d68b18328af5ea80d8cf67ed443a202a19a43d13bf2661487e2d7bac420d3feb1ea9826d248a96738875b9df1e

Score
10/10
massloggerspywarestealer

Malware Config

Targets

    • Target

      5f248cb4805098190906c9fd9dd9caa8.exe

    • Size

      1.1MB

    • MD5

      5f248cb4805098190906c9fd9dd9caa8

    • SHA1

      49d5b6670b587a6f1c4d94f8aa6e0af7c0c9c0f6

    • SHA256

      eda87d9c8cca853fe6620d6a246f94a8ee739c7278fb4c68c46374b598cdb842

    • SHA512

      2444545aeaf33f30318fc6b795e5fa7eaf7258d68b18328af5ea80d8cf67ed443a202a19a43d13bf2661487e2d7bac420d3feb1ea9826d248a96738875b9df1e

    Score
    10/10
    stealerspywaremasslogger

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger log file

      Detects a log file produced by MassLogger.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks