General

  • Target

    331bbdf8a4653e6bbdb2011a6b89099e2148a15fe44221d9852f7117b8105a51

  • Size

    835KB

  • Sample

    220330-clvrgaeef7

  • MD5

    a53df39071210ff353e46de71eb36dc6

  • SHA1

    3988e9828dffc4a2353bd8cfbabb161d0a896ac3

  • SHA256

    331bbdf8a4653e6bbdb2011a6b89099e2148a15fe44221d9852f7117b8105a51

  • SHA512

    c82f198639e26a7efa1e2d7a95d865a95bbc74f6df621f3944a07b511107cbec24616ffa763b525ea0eec466f51a42b2923d2f52a18e8d40412a6d46b76d680c

Malware Config

Targets

    • Target

      331bbdf8a4653e6bbdb2011a6b89099e2148a15fe44221d9852f7117b8105a51

    • Size

      835KB

    • MD5

      a53df39071210ff353e46de71eb36dc6

    • SHA1

      3988e9828dffc4a2353bd8cfbabb161d0a896ac3

    • SHA256

      331bbdf8a4653e6bbdb2011a6b89099e2148a15fe44221d9852f7117b8105a51

    • SHA512

      c82f198639e26a7efa1e2d7a95d865a95bbc74f6df621f3944a07b511107cbec24616ffa763b525ea0eec466f51a42b2923d2f52a18e8d40412a6d46b76d680c

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger Main Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v6

Tasks