Overview

overview

10

Static

static

PURCHASE.exe

windows7_x64

10

PURCHASE.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PURCHASE.exe

  • Size

    1.0MB

  • Sample

    201201-77bkqbhnga

  • MD5

    9d1cdf69f551af40c1a7751c978cf097

  • SHA1

    bb7e5cd610da1dfe8004ef3bbca45013b502f7bf

  • SHA256

    01b712edb711a5ff50c21720fbca31081e9e376b4abd410f235d6d0e0d043726

  • SHA512

    d88ff5f569071d96589793fc4b693e158fef351f553a5cd189ac10c295b0df9636cce6d3e41d0b70dc318fe86c65e6983f94c861b9e177d06b83cea9341f1e0c

Score
10/10
massloggerspywarestealer

Malware Config

Targets

    • Target

      PURCHASE.exe

    • Size

      1.0MB

    • MD5

      9d1cdf69f551af40c1a7751c978cf097

    • SHA1

      bb7e5cd610da1dfe8004ef3bbca45013b502f7bf

    • SHA256

      01b712edb711a5ff50c21720fbca31081e9e376b4abd410f235d6d0e0d043726

    • SHA512

      d88ff5f569071d96589793fc4b693e158fef351f553a5cd189ac10c295b0df9636cce6d3e41d0b70dc318fe86c65e6983f94c861b9e177d06b83cea9341f1e0c

    Score
    10/10
    massloggerspywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks