Overview

overview

10

Static

static

wBn3alSjAhQUdu5.exe

windows7_x64

10

wBn3alSjAhQUdu5.exe

windows10_x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    wBn3alSjAhQUdu5.exe

  • Size

    1002KB

  • Sample

    200714-w6tec8ne5x

  • MD5

    6a9d67850b1e7768e65877a1aae6ffc6

  • SHA1

    5667a805545fa50a203a5fd4dc01a3615b5bf646

  • SHA256

    7029f74bfaf5637a25dad61b7a7462141833886ac9637790d0fdaf7e72d84a3f

  • SHA512

    92c85a6f54b2c1607095af63c47b359e72eead1f58f69121bbfa9c76dd287d28a6ebdc4ff1cb71e7113fdffdf6559f3c95388b48328e53d1e0a6777b0d133f1c

Score
10/10
massloggerspywarestealer

Malware Config

Targets

    • Target

      wBn3alSjAhQUdu5.exe

    • Size

      1002KB

    • MD5

      6a9d67850b1e7768e65877a1aae6ffc6

    • SHA1

      5667a805545fa50a203a5fd4dc01a3615b5bf646

    • SHA256

      7029f74bfaf5637a25dad61b7a7462141833886ac9637790d0fdaf7e72d84a3f

    • SHA512

      92c85a6f54b2c1607095af63c47b359e72eead1f58f69121bbfa9c76dd287d28a6ebdc4ff1cb71e7113fdffdf6559f3c95388b48328e53d1e0a6777b0d133f1c

    Score
    10/10
    spywarestealermasslogger

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger log file

      Detects a log file produced by MassLogger.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks