masslogger

General

Target

Purchase Order.bin.zip
Size

763KB
Sample

210701-3bhnd4t8ga
MD5

1d4695bdb7a33f3ed2bac25583ba7dec
SHA1

1a0d3d9a342aeb2b6b6cae321670782e02a93c43
SHA256

dca658061fb2df8d101b1c77374aef528954b126a679daa7e20b21b27a6b4a13
SHA512

f2e4a955e1d4c458e955f32d32408f1ea8c225c5b6fae35ee7f50a4aa50971a604f56443111059eb3266a411d8c7c633a1e29df674057738dc171c472bcede91

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\5089EDCC92\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.8.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States Windows OS: Microsoft Windows 7 Ultimate 64bit Windows Serial Key: HYF8J-CVRMY-CM74G-RPHKF-PW487 CPU: Persocon Processor 2.5+ GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 7/1/2021 4:34:04 AM MassLogger Started: 7/1/2021 4:33:58 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\Purchase Order.bin.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\1A60FBA9DF\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.8.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.13 Location: United States Windows OS: Microsoft Windows 10 Enterprise64bit Windows Serial Key: W269N-WFGWX-YVC9B-4J6C9-T83GX CPU: Persocon Processor 2.5+ GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 7/1/2021 6:40:40 AM MassLogger Started: 7/1/2021 6:40:35 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\Purchase Order.bin.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Targets

- Target
  
  Purchase Order.bin
- Size
  
  796KB
- MD5
  
  a055b63f32102d1b5ba0d7064d75526b
- SHA1
  
  6032e66d65cf7992162047780ccadbee38751dea
- SHA256
  
  6ad5aee17e0fa5baa1a5ba9b0375faa8e98ff72dd4a79e5fb8209237167e119d
- SHA512
  
  45b6b104f848a993cea0854ee65fc9a88b5cac379db492f7c850dfa787efa9c8d82a403c7d868683303b6e7e5e4068a1eea830330359e633a9f3e7c2e1b37024
Score

10^/10

masslogger evasion ransomware rezer0 spyware stealer
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger Main Payload
- MassLogger log file
  Detects a log file produced by MassLogger.
- Looks for VirtualBox Guest Additions in registry
  evasion
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2