Overview

overview

10

Static

static

MLY.exe

windows7_x64

10

MLY.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    MLY.exe

  • Size

    1.1MB

  • Sample

    200713-r4qtfp3qea

  • MD5

    02ef1facb39aca762039fddc98190813

  • SHA1

    50b03f32e5581fb01e4a6d86c1a3c0757079a784

  • SHA256

    fe20e8e7fb4c597777c529cb419b0eec1f3cf6d5c5bfdea31e3df0b1014da7a9

  • SHA512

    bae96c5f9f1a2f40931b894a17bb469461239cc0af297488e04b1cdc89934019777f7a0243322fed60f16ad8e548fd1ec45e443e013b90d5f00412f4c43201c5

Score
10/10
massloggerspywarestealer

Malware Config

Targets

    • Target

      MLY.exe

    • Size

      1.1MB

    • MD5

      02ef1facb39aca762039fddc98190813

    • SHA1

      50b03f32e5581fb01e4a6d86c1a3c0757079a784

    • SHA256

      fe20e8e7fb4c597777c529cb419b0eec1f3cf6d5c5bfdea31e3df0b1014da7a9

    • SHA512

      bae96c5f9f1a2f40931b894a17bb469461239cc0af297488e04b1cdc89934019777f7a0243322fed60f16ad8e548fd1ec45e443e013b90d5f00412f4c43201c5

    Score
    10/10
    stealerspywaremasslogger

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger log file

      Detects a log file produced by MassLogger.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks