General
-
Target
5 days Itinerery.doc
-
Size
525KB
-
Sample
201217-dfs8g7klxe
-
MD5
3e61c3fcfbce2d0100a3b4c8fcbdb945
-
SHA1
6f6673ab5b88a1f3f9b651026957c3a333657040
-
SHA256
19016227bbad1d388ed7c0ad968a882e7e7702457257426931f6d6005eea5472
-
SHA512
1f2570e4e1c306c885adaac8e3103f0f7f127641ed9d49d2f5d96d151f80d1a5e591b592f098cf3b19b80da7512df5c8d092c031e95cd7c1e6cba4dbc4d5cd98
Static task
static1
Behavioral task
behavioral1
Sample
5 days Itinerery.doc
Resource
win7v20201028
Behavioral task
behavioral2
Sample
5 days Itinerery.doc
Resource
win10v20201028
Malware Config
Extracted
C:\Users\Admin\AppData\Local\5FADD7138A\Log.txt
masslogger
Targets
-
-
Target
5 days Itinerery.doc
-
Size
525KB
-
MD5
3e61c3fcfbce2d0100a3b4c8fcbdb945
-
SHA1
6f6673ab5b88a1f3f9b651026957c3a333657040
-
SHA256
19016227bbad1d388ed7c0ad968a882e7e7702457257426931f6d6005eea5472
-
SHA512
1f2570e4e1c306c885adaac8e3103f0f7f127641ed9d49d2f5d96d151f80d1a5e591b592f098cf3b19b80da7512df5c8d092c031e95cd7c1e6cba4dbc4d5cd98
Score10/10-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload
-
MassLogger log file
Detects a log file produced by MassLogger.
-
ServiceHost packer
Detects ServiceHost packer used for .NET malware
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-