General

  • Target

    5fa29b2a0a86144477ff75ad70fe603d.exe

  • Size

    47KB

  • Sample

    201218-va14qxsfr6

  • MD5

    5fa29b2a0a86144477ff75ad70fe603d

  • SHA1

    c3de3b71b61b70be7b00c96d643cbad44f4e0598

  • SHA256

    72c2e8990fede91615555d69a7bfe061476e56e3fd4b4bf86217aa9ae816c571

  • SHA512

    e7bdb49720b721cb36a9bf689007555edce3b0281e9e35cec24e5fec0a460157f83e423f08cc980f7d626765791791150a096e51a014d521f9f8f2ed36898e51

Malware Config

Targets

    • Target

      5fa29b2a0a86144477ff75ad70fe603d.exe

    • Size

      47KB

    • MD5

      5fa29b2a0a86144477ff75ad70fe603d

    • SHA1

      c3de3b71b61b70be7b00c96d643cbad44f4e0598

    • SHA256

      72c2e8990fede91615555d69a7bfe061476e56e3fd4b4bf86217aa9ae816c571

    • SHA512

      e7bdb49720b721cb36a9bf689007555edce3b0281e9e35cec24e5fec0a460157f83e423f08cc980f7d626765791791150a096e51a014d521f9f8f2ed36898e51

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Tasks