General

  • Target

    458b8b62a3dea11f18a4ead71770dcba0d18a367955bd4f82413e28f53c3339e

  • Size

    1.7MB

  • Sample

    220414-n278aacehq

  • MD5

    45aa1d943161c988f7391b0cad4e2b89

  • SHA1

    7056c0d8cf9d51d9385f0b0612e7b53b311c5ee3

  • SHA256

    458b8b62a3dea11f18a4ead71770dcba0d18a367955bd4f82413e28f53c3339e

  • SHA512

    93c04b235d8f12e44861fe531a7cf669ced3c08286d2c2012498d646a63850c8f7bb94382225db2494ab9e9c652084359eed217abeb94f9fe81f3a0951ef6bb3

Malware Config

Targets

    • Target

      458b8b62a3dea11f18a4ead71770dcba0d18a367955bd4f82413e28f53c3339e

    • Size

      1.7MB

    • MD5

      45aa1d943161c988f7391b0cad4e2b89

    • SHA1

      7056c0d8cf9d51d9385f0b0612e7b53b311c5ee3

    • SHA256

      458b8b62a3dea11f18a4ead71770dcba0d18a367955bd4f82413e28f53c3339e

    • SHA512

      93c04b235d8f12e44861fe531a7cf669ced3c08286d2c2012498d646a63850c8f7bb94382225db2494ab9e9c652084359eed217abeb94f9fe81f3a0951ef6bb3

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks