masslogger

General

Target
ABU.exe
Size 1.1MB
Sample200719-bk8rpvws66
SHA256 63dfa8d2edddff1965c17df05de30c3d24ada34cc632d0f3a1a03c87f670674b
MD5 0c49690e4c856a525390d81ff0786f8a
SHA1 b57c2cee42496453dd3ad135cefa6315d1611cd1
SHA512 5b999b912d0426d475e258cd5271d97ba79f92a3b54a089ec77012460c31d06be6c1b7c3dbb8d7c05807e6dab853b58323efb2040680a60ba4b0fad1b50c9a5e
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\E2C1E8F1FA\Log.txt

masslogger

Ransom Note

################################################################# MassLogger v1.3.3.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States OS: Microsoft Windows 7 Professional 64bit CPU: Persocon Processor 2.5+ GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 7/19/2020 8:29:38 PM MassLogger Started: 7/19/2020 8:29:32 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Roaming\appdata\akdirou.exe As Administrator: True

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\D2BC2E352A\Log.txt

masslogger

Ransom Note

################################################################# MassLogger v1.3.3.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.13 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Persocon Processor 2.5+ GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 7/19/2020 10:28:51 PM MassLogger Started: 7/19/2020 10:28:46 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Roaming\appdata\akdirou.exe As Administrator: True

Targets

- Target
  ABU.exe
- Size 1.1MB
- SHA256 63dfa8d2edddff1965c17df05de30c3d24ada34cc632d0f3a1a03c87f670674b
- MD5 0c49690e4c856a525390d81ff0786f8a
- SHA1 b57c2cee42496453dd3ad135cefa6315d1611cd1
- SHA512 5b999b912d0426d475e258cd5271d97ba79f92a3b54a089ec77012460c31d06be6c1b7c3dbb8d7c05807e6dab853b58323efb2040680a60ba4b0fad1b50c9a5e
- MD5 SHA1 SHA512
Score

10^/10

ransomware upx spyware stealer masslogger
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger log file
  Detects a log file produced by MassLogger.
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

MassLogger log file

Executes dropped EXE

UPX packed file

Drops startup file

Loads dropped DLL

Reads user/profile data of web browsers

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2