General

  • Target

    013e9f929c6659f6df656244337eac2c0e398a918f8cacb57bf7d5df2c07d773

  • Size

    975KB

  • Sample

    220320-bdcegsdfg6

  • MD5

    3c14dcd3e48240c56f1c25ff210557b9

  • SHA1

    5c4f025fb6877ad45263e0e40979c41890c1c355

  • SHA256

    013e9f929c6659f6df656244337eac2c0e398a918f8cacb57bf7d5df2c07d773

  • SHA512

    49c644256da4ecce62f32bc25cf3e81b40e89da6f057cff610e815442fa92e8819ddabeaf1a62bd18a9bff41bd4cd5ba063527232eeeaf2c5f8bd4cdd8749b7a

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    ayocj@2021

Targets

    • Target

      013e9f929c6659f6df656244337eac2c0e398a918f8cacb57bf7d5df2c07d773

    • Size

      975KB

    • MD5

      3c14dcd3e48240c56f1c25ff210557b9

    • SHA1

      5c4f025fb6877ad45263e0e40979c41890c1c355

    • SHA256

      013e9f929c6659f6df656244337eac2c0e398a918f8cacb57bf7d5df2c07d773

    • SHA512

      49c644256da4ecce62f32bc25cf3e81b40e89da6f057cff610e815442fa92e8819ddabeaf1a62bd18a9bff41bd4cd5ba063527232eeeaf2c5f8bd4cdd8749b7a

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks