General

  • Target

    b26ce61545c7e70ac665d815f408921ff90a53ccb97d1907d4fcff3f24771163

  • Size

    1.3MB

  • Sample

    220415-psh3gacch9

  • MD5

    485248edb2eba735ba7e32c7f0b4de1b

  • SHA1

    a2f4011df980da9bb8306608754daca756f3f919

  • SHA256

    b26ce61545c7e70ac665d815f408921ff90a53ccb97d1907d4fcff3f24771163

  • SHA512

    8861f2e3c467e5eb3e87aa40d3b1038f72f6dbc139d35e7b7a6607f78d8c8406822de7e0a5b995e3acdc94d10d4fa6831e58fdc96a1307b11d44a586316b9725

Malware Config

Targets

    • Target

      b26ce61545c7e70ac665d815f408921ff90a53ccb97d1907d4fcff3f24771163

    • Size

      1.3MB

    • MD5

      485248edb2eba735ba7e32c7f0b4de1b

    • SHA1

      a2f4011df980da9bb8306608754daca756f3f919

    • SHA256

      b26ce61545c7e70ac665d815f408921ff90a53ccb97d1907d4fcff3f24771163

    • SHA512

      8861f2e3c467e5eb3e87aa40d3b1038f72f6dbc139d35e7b7a6607f78d8c8406822de7e0a5b995e3acdc94d10d4fa6831e58fdc96a1307b11d44a586316b9725

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks