General

  • Target

    DHL_Dec 2021 at 8.N_91B7290_PDF.exe

  • Size

    717KB

  • Sample

    210111-hkxt4ldy4n

  • MD5

    e3f6420a0f2e060eaca4c8e02398b9db

  • SHA1

    294d1769ef0331aed33366f3cc52dd41b3588e04

  • SHA256

    6b35792d37ac6bb94a74d471840852812de8b2b67f09f3cb32e2a0e6d4d699e3

  • SHA512

    b3deda7ece9ae260df0a1839f29560e094d348731b50b63c213e78c290eae58a988c4c7313c8fa9550d07a34965a249061fa846da817a6c9b0c360badd759668

Malware Config

Targets

    • Target

      DHL_Dec 2021 at 8.N_91B7290_PDF.exe

    • Size

      717KB

    • MD5

      e3f6420a0f2e060eaca4c8e02398b9db

    • SHA1

      294d1769ef0331aed33366f3cc52dd41b3588e04

    • SHA256

      6b35792d37ac6bb94a74d471840852812de8b2b67f09f3cb32e2a0e6d4d699e3

    • SHA512

      b3deda7ece9ae260df0a1839f29560e094d348731b50b63c213e78c290eae58a988c4c7313c8fa9550d07a34965a249061fa846da817a6c9b0c360badd759668

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Tasks