General
- Target bcde524b772c9f744261208f01f33f0229342d619deb4d31b83bde042a9020ac
- Size 3.6MB
- Sample220415-ktzz6aedbq
- SHA256 bcde524b772c9f744261208f01f33f0229342d619deb4d31b83bde042a9020ac
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\AppData\Local\EEB932C954\Log.txt
-
masslogger
Ransom Note
- <|| v2.4.0.0 ||> User Name: Admin IP: 154.61.71.13 Location: United States Windows OS: Microsoft Windows 10 Pro 64bit Windows Serial Key: W269N-WFGWX-YVC9B-4J6C9-T83GX CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 4/15/2022 1:18:41 PM MassLogger Started: 4/15/2022 1:18:29 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\bcde524b772c9f744261208f01f33f0229342d619deb4d31b83bde042a9020ac.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: <|| WD Exclusion ||> Disabled <|| Binder ||> Disabled <|| Downloader ||> Disabled <|| Window Searcher ||> Disabled <|| Bot Killer ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> NA
Targets
-
- Target bcde524b772c9f744261208f01f33f0229342d619deb4d31b83bde042a9020ac
- Size 3.6MB
- SHA256 bcde524b772c9f744261208f01f33f0229342d619deb4d31b83bde042a9020ac
Score10/10MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
MassLogger log file
Detects a log file produced by MassLogger.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Suspicious use of SetThreadContext