Overview

overview

10

Static

static

DHL_Januar...DF.exe

windows7_x64

10

DHL_Januar...DF.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DHL_January 2021 at 28M_9B7290_PDF.exe

  • Size

    727KB

  • Sample

    210114-bdry9xrasn

  • MD5

    c13081675ef4f1fea467c18c31bf2492

  • SHA1

    6683c8d513c50cbe2a5999a4a5c31c4a90aeb01d

  • SHA256

    2d9b9f417d914d2b6f3bc2eefbe9b82ec3eacd8077f2ad4a1a05f393f8584bc8

  • SHA512

    76da00c45c88387f03eb727ad5ff948b39029a1c19d2f13070f08de94b9ec6084dea683b6345a2116c9a3b201f8d7ccd826c4343dcf5f04268ebc889981847a7

Score
10/10
massloggerspywarestealer

Malware Config

Targets

    • Target

      DHL_January 2021 at 28M_9B7290_PDF.exe

    • Size

      727KB

    • MD5

      c13081675ef4f1fea467c18c31bf2492

    • SHA1

      6683c8d513c50cbe2a5999a4a5c31c4a90aeb01d

    • SHA256

      2d9b9f417d914d2b6f3bc2eefbe9b82ec3eacd8077f2ad4a1a05f393f8584bc8

    • SHA512

      76da00c45c88387f03eb727ad5ff948b39029a1c19d2f13070f08de94b9ec6084dea683b6345a2116c9a3b201f8d7ccd826c4343dcf5f04268ebc889981847a7

    Score
    10/10
    massloggerspywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks