masslogger

General

Target

Purchase Order.bin (1).zip
Size

763KB
Sample

210701-v2dp3llsja
MD5

90be44a8c9f063e2ed34279710347275
SHA1

5280dcb110710a50cc1a534fb3b2401d44a53bfd
SHA256

c5734f344026505b9e5ffe5139ae5694acdbcbbcdabb09db0be350b959f26040
SHA512

452dbcd62ade399c95e6a97e35a99f999bf853c94e74e8e88dece35b2c39afd735989117282266386129032a3a172f25b4ea571136f9ea58799cbe46fdb3a2dd

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\5089EDCC92\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.8.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States Windows OS: Microsoft Windows 7 Ultimate 64bit Windows Serial Key: HYF8J-CVRMY-CM74G-RPHKF-PW487 CPU: Persocon Processor 2.5+ GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 7/1/2021 4:45:37 AM MassLogger Started: 7/1/2021 4:45:30 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\Purchase Order.bin.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\1A60FBA9DF\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.8.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.13 Location: United States Windows OS: Microsoft Windows 10 Enterprise64bit Windows Serial Key: W269N-WFGWX-YVC9B-4J6C9-T83GX CPU: Persocon Processor 2.5+ GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 7/1/2021 6:45:03 AM MassLogger Started: 7/1/2021 6:44:59 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\Purchase Order.bin.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Targets

- Target
  
  Purchase Order.bin
- Size
  
  796KB
- MD5
  
  a055b63f32102d1b5ba0d7064d75526b
- SHA1
  
  6032e66d65cf7992162047780ccadbee38751dea
- SHA256
  
  6ad5aee17e0fa5baa1a5ba9b0375faa8e98ff72dd4a79e5fb8209237167e119d
- SHA512
  
  45b6b104f848a993cea0854ee65fc9a88b5cac379db492f7c850dfa787efa9c8d82a403c7d868683303b6e7e5e4068a1eea830330359e633a9f3e7c2e1b37024
Score

10^/10

masslogger evasion ransomware rezer0 spyware stealer
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger Main Payload
- MassLogger log file
  Detects a log file produced by MassLogger.
- Looks for VirtualBox Guest Additions in registry
  evasion
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2