General

  • Target

    98c78f4a9b3ee333efec27d29c33b073e0e55930d31257eabbfe9bbbf4775511

  • Size

    830KB

  • Sample

    220326-h8ydrshhg8

  • MD5

    9d547cdfaa4bdfc8329ce71b1980e36c

  • SHA1

    ffb5585af1c1f5ee36417116b8ed010e1383d906

  • SHA256

    98c78f4a9b3ee333efec27d29c33b073e0e55930d31257eabbfe9bbbf4775511

  • SHA512

    56574e089ab9df6c068812866fac7983bbd0fe1dcd75e1da9e2d4f240393a6eb3b1db43b4a59daf5c82461e97e78df68d6a1ec18ea4449effd38ee33e0f3a40d

Malware Config

Targets

    • Target

      98c78f4a9b3ee333efec27d29c33b073e0e55930d31257eabbfe9bbbf4775511

    • Size

      830KB

    • MD5

      9d547cdfaa4bdfc8329ce71b1980e36c

    • SHA1

      ffb5585af1c1f5ee36417116b8ed010e1383d906

    • SHA256

      98c78f4a9b3ee333efec27d29c33b073e0e55930d31257eabbfe9bbbf4775511

    • SHA512

      56574e089ab9df6c068812866fac7983bbd0fe1dcd75e1da9e2d4f240393a6eb3b1db43b4a59daf5c82461e97e78df68d6a1ec18ea4449effd38ee33e0f3a40d

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks