General

  • Target

    3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e

  • Size

    821KB

  • Sample

    220326-see1faeah3

  • MD5

    b0c6c62c19099f962f6a8c942051c33d

  • SHA1

    0985c98469e35361d235df11417b0bf9ead7f110

  • SHA256

    3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e

  • SHA512

    bc9710bf121a9c4887a317931e60b57f73497bd836e918e1765812bedbc312af611e8c298860b44bce2ecc3a3776725b0be4cb4091382d74d41e94930897e735

Malware Config

Targets

    • Target

      3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e

    • Size

      821KB

    • MD5

      b0c6c62c19099f962f6a8c942051c33d

    • SHA1

      0985c98469e35361d235df11417b0bf9ead7f110

    • SHA256

      3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e

    • SHA512

      bc9710bf121a9c4887a317931e60b57f73497bd836e918e1765812bedbc312af611e8c298860b44bce2ecc3a3776725b0be4cb4091382d74d41e94930897e735

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks