General
- Target RFQ_01NDN8020901.PDF.exe
- Size 523KB
- Sample200820-4vcvb8wbta
- SHA256 34ea4b1bf96a120fd6f9969babeae255483e42a496cdba637c6ef1f44c2b4287
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\AppData\Local\D3B3AADFF1\Log.txt
-
masslogger
Ransom Note
- <|| v2.4.0.0 ||> User Name: Admin IP: 154.61.71.51 Location: United States Windows OS: Microsoft Windows 7 Professional 64bit Windows Serial Key: HYF8J-CVRMY-CM74G-RPHKF-PW487 CPU: Persocon Processor 2.5+ GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 8/20/2020 6:30:20 AM MassLogger Started: 8/20/2020 6:30:13 AM Interval: 2 hour MassLogger Process: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: Name:AcroRd32, Title:1003634_revX01.pdf - Adobe Reader <|| WD Exclusion ||> Disabled <|| Binder ||> Disabled <|| Downloader ||> Disabled <|| Window Searcher ||> Disabled <|| Bot Killer ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> NA
Targets
-
- Target RFQ_01NDN8020901.PDF.exe
- Size 523KB
- SHA256 34ea4b1bf96a120fd6f9969babeae255483e42a496cdba637c6ef1f44c2b4287
Score10/10MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
MassLogger log file
Detects a log file produced by MassLogger.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Uses the VBS compiler for execution
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Suspicious use of SetThreadContext