Overview

overview

10

Static

static

SKM_C25820...20.exe

windows7_x64

10

SKM_C25820...20.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SKM_C25820112116120.exe

  • Size

    1.2MB

  • Sample

    201121-bd7xsfdv2x

  • MD5

    2559a4a701f88d7793082cea77f7a73c

  • SHA1

    5548a12e53461128020f9feaefdeac7f797e2830

  • SHA256

    5f53adb34adbcb6eeec29d48e9d80a401d1476eff2e826cb2c7ac02d8d7e2785

  • SHA512

    a929420bb0bb9fc22262dbec8145a3c451e241a096c18eb3bd3e78c7766e5b021fcc9462477ea58866f4b329d65a2f2e3ec738fbf64d4dadd201cb3eab428ca2

Score
10/10
massloggerspywarestealer

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.turkaykalibrasyon.com
  • Port:
    587
  • Username:
    turkay@turkaykalibrasyon.com
  • Password:
    Cc_8A46

Targets

    • Target

      SKM_C25820112116120.exe

    • Size

      1.2MB

    • MD5

      2559a4a701f88d7793082cea77f7a73c

    • SHA1

      5548a12e53461128020f9feaefdeac7f797e2830

    • SHA256

      5f53adb34adbcb6eeec29d48e9d80a401d1476eff2e826cb2c7ac02d8d7e2785

    • SHA512

      a929420bb0bb9fc22262dbec8145a3c451e241a096c18eb3bd3e78c7766e5b021fcc9462477ea58866f4b329d65a2f2e3ec738fbf64d4dadd201cb3eab428ca2

    Score
    10/10
    massloggerspywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks