Overview

overview

10

Static

static

c8da1e1e_e...ed.exe

windows7_x64

10

c8da1e1e_e...ed.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c8da1e1e_extracted

  • Size

    1.3MB

  • Sample

    210304-429qd7fmte

  • MD5

    b062a7fb1dde5658f46c45d8e6bb8cf6

  • SHA1

    327adad9b7c50b7c62a859b17c0b64af22b2c8ab

  • SHA256

    20f7a1696665e085deded2f5ab6d982a9e6a804d2dd665e7d1a6d7eab78e5a0d

  • SHA512

    4296208d310edede301b618eb78ff1611498d03920fddebebc311ad66437fa72425786058d674ae73a4cb3644bc30cb1298fd5bbadcc61ea8fe0647645a3bbce

Score
10/10
massloggerspywarestealerupx

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    chrispaged12@yandex.com
  • Password:
    Chinedu22@

Targets

    • Target

      c8da1e1e_extracted

    • Size

      1.3MB

    • MD5

      b062a7fb1dde5658f46c45d8e6bb8cf6

    • SHA1

      327adad9b7c50b7c62a859b17c0b64af22b2c8ab

    • SHA256

      20f7a1696665e085deded2f5ab6d982a9e6a804d2dd665e7d1a6d7eab78e5a0d

    • SHA512

      4296208d310edede301b618eb78ff1611498d03920fddebebc311ad66437fa72425786058d674ae73a4cb3644bc30cb1298fd5bbadcc61ea8fe0647645a3bbce

    Score
    10/10
    massloggerspywarestealerupx

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger log file

      Detects a log file produced by MassLogger.

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks