General

  • Target

    554e73533c3dbdf6c4fa0d4a3404ef7997d05c0886ff65d9c8c538663550fd88

  • Size

    1.0MB

  • Sample

    220415-tnjknahcam

  • MD5

    a427fa19edceed5c843947b91f52aea9

  • SHA1

    13d9e0da2f94c66f60d83e6cb67fba608ab6d4b4

  • SHA256

    554e73533c3dbdf6c4fa0d4a3404ef7997d05c0886ff65d9c8c538663550fd88

  • SHA512

    5cab06db2cb641e88a40e09b47b458e46330f475b960b7a1ac81f51b57c30e1e49b7fea47567c61be1ae31061d31132c3f6848f2f06de2e2cc61d20c236674e3

Malware Config

Targets

    • Target

      554e73533c3dbdf6c4fa0d4a3404ef7997d05c0886ff65d9c8c538663550fd88

    • Size

      1.0MB

    • MD5

      a427fa19edceed5c843947b91f52aea9

    • SHA1

      13d9e0da2f94c66f60d83e6cb67fba608ab6d4b4

    • SHA256

      554e73533c3dbdf6c4fa0d4a3404ef7997d05c0886ff65d9c8c538663550fd88

    • SHA512

      5cab06db2cb641e88a40e09b47b458e46330f475b960b7a1ac81f51b57c30e1e49b7fea47567c61be1ae31061d31132c3f6848f2f06de2e2cc61d20c236674e3

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks