masslogger

General

Target
PO# 2001840394 - NEW ORDER.exe
Size 1.2MB
Sample201109-3dkq75rjqa
SHA256 b88b1caee334cbd27f17d4310f2b51c26a5a9411452ad2f4b7fa17e1e81b59fb
MD5 5023566d205bcc7958ccbc84be950e9d
SHA1 4f7f6f3ad838506c5b141537f413eb341bf17027
SHA512 732c033c5c38464f2255e964054d1e4d727cd31f7c64817d9a29e3d44da30583c2e552646f7fbc4a37e4662a4457c2c40abd1ee95d80ddd84e62b20e004deaa6
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\5FADD7138A\Log.txt

masslogger

Ransom Note

################################################################# MassLogger v1.3.7.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States Windows OS: Microsoft Windows 7 Professional 64bit Windows Serial Key: HYF8J-CVRMY-CM74G-RPHKF-PW487 CPU: Persocon Processor 2.5+ GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 11/11/2020 3:03:31 AM MassLogger Started: 11/11/2020 3:03:25 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\RegAsm.exe MassLogger Melt: true MassLogger Exit after delivery: false As Administrator: True Processes:

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\CC3AB4D6D6\Log.txt

masslogger

Ransom Note

################################################################# MassLogger v1.3.7.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States Windows OS: Microsoft Windows 10 Pro64bit Windows Serial Key: W269N-WFGWX-YVC9B-4J6C9-T83GX CPU: Persocon Processor 2.5+ GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 11/11/2020 3:03:24 AM MassLogger Started: 11/11/2020 3:03:20 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\RegAsm.exe MassLogger Melt: true MassLogger Exit after delivery: false As Administrator: True Processes:

Targets

- Target
  PO# 2001840394 - NEW ORDER.exe
- Size 1.2MB
- SHA256 b88b1caee334cbd27f17d4310f2b51c26a5a9411452ad2f4b7fa17e1e81b59fb
- MD5 5023566d205bcc7958ccbc84be950e9d
- SHA1 4f7f6f3ad838506c5b141537f413eb341bf17027
- SHA512 732c033c5c38464f2255e964054d1e4d727cd31f7c64817d9a29e3d44da30583c2e552646f7fbc4a37e4662a4457c2c40abd1ee95d80ddd84e62b20e004deaa6
- MD5 SHA1 SHA512
Score

10^/10

masslogger agilenet ransomware spyware stealer
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger Main Payload
- MassLogger log file
  Detects a log file produced by MassLogger.
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

MassLogger Main Payload

MassLogger log file

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Obfuscated with Agile.Net obfuscator

Reads user/profile data of web browsers

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2