General

  • Target

    bbb12d64ae640443e791b7444c35c066fd8b843551151872c0a1c86d483cd0e6

  • Size

    417KB

  • Sample

    220327-hywr7aegb7

  • MD5

    fdb8625f5cefaa8f09a9036b1ca9c639

  • SHA1

    15dc5373fddfb056d70d23e52645f0706218cddd

  • SHA256

    bbb12d64ae640443e791b7444c35c066fd8b843551151872c0a1c86d483cd0e6

  • SHA512

    82293a6e7c59b0268cc86fd357e1f5a7d4184cad055be3998d18d860bd052d7b8a3448416cbd47f6d661a4b74a8681ea94781be45c3811057a10f3dc649dfb8e

Malware Config

Targets

    • Target

      bbb12d64ae640443e791b7444c35c066fd8b843551151872c0a1c86d483cd0e6

    • Size

      417KB

    • MD5

      fdb8625f5cefaa8f09a9036b1ca9c639

    • SHA1

      15dc5373fddfb056d70d23e52645f0706218cddd

    • SHA256

      bbb12d64ae640443e791b7444c35c066fd8b843551151872c0a1c86d483cd0e6

    • SHA512

      82293a6e7c59b0268cc86fd357e1f5a7d4184cad055be3998d18d860bd052d7b8a3448416cbd47f6d661a4b74a8681ea94781be45c3811057a10f3dc649dfb8e

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v6

Tasks