General
-
Target
vygtHoQaI1KaBVp.exe
-
Size
980KB
-
Sample
201213-7eceydnxn2
-
MD5
fefb56014a9cd5fc500beff6fe23c393
-
SHA1
eda7524f10ed1e2ef5d34265023fc1f84b9a6dcf
-
SHA256
e66fe8dc103a47069c3a56658a72e62e4c17a3d1ed1fbf76185ebd246df7823f
-
SHA512
34e09104cdf159cadcb60738731bfe5e82c4433f8c72b46e6e85909dcf50c897e5045fbec75595bcf9d9ddcca380ea974fd0e52aefe90b55ee7eef60483110b2
Static task
static1
Behavioral task
behavioral1
Sample
vygtHoQaI1KaBVp.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
vygtHoQaI1KaBVp.exe
Resource
win10v20201028
Malware Config
Extracted
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
ayocj@2021
Targets
-
-
Target
vygtHoQaI1KaBVp.exe
-
Size
980KB
-
MD5
fefb56014a9cd5fc500beff6fe23c393
-
SHA1
eda7524f10ed1e2ef5d34265023fc1f84b9a6dcf
-
SHA256
e66fe8dc103a47069c3a56658a72e62e4c17a3d1ed1fbf76185ebd246df7823f
-
SHA512
34e09104cdf159cadcb60738731bfe5e82c4433f8c72b46e6e85909dcf50c897e5045fbec75595bcf9d9ddcca380ea974fd0e52aefe90b55ee7eef60483110b2
Score10/10-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-