General

  • Target

    vygtHoQaI1KaBVp.exe

  • Size

    980KB

  • Sample

    201213-7eceydnxn2

  • MD5

    fefb56014a9cd5fc500beff6fe23c393

  • SHA1

    eda7524f10ed1e2ef5d34265023fc1f84b9a6dcf

  • SHA256

    e66fe8dc103a47069c3a56658a72e62e4c17a3d1ed1fbf76185ebd246df7823f

  • SHA512

    34e09104cdf159cadcb60738731bfe5e82c4433f8c72b46e6e85909dcf50c897e5045fbec75595bcf9d9ddcca380ea974fd0e52aefe90b55ee7eef60483110b2

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    ayocj@2021

Targets

    • Target

      vygtHoQaI1KaBVp.exe

    • Size

      980KB

    • MD5

      fefb56014a9cd5fc500beff6fe23c393

    • SHA1

      eda7524f10ed1e2ef5d34265023fc1f84b9a6dcf

    • SHA256

      e66fe8dc103a47069c3a56658a72e62e4c17a3d1ed1fbf76185ebd246df7823f

    • SHA512

      34e09104cdf159cadcb60738731bfe5e82c4433f8c72b46e6e85909dcf50c897e5045fbec75595bcf9d9ddcca380ea974fd0e52aefe90b55ee7eef60483110b2

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks