General

  • Target

    365ac8d843f9690a794710bfb8eeea25cc2abffc7d1098250ca73ebd4e9178ad

  • Size

    659KB

  • Sample

    220418-pwb4bsfgap

  • MD5

    5e516df77bc717bd4a412b775324d07b

  • SHA1

    eb81e16bbd27ee46a987f24933d37c65ffc5667b

  • SHA256

    365ac8d843f9690a794710bfb8eeea25cc2abffc7d1098250ca73ebd4e9178ad

  • SHA512

    dfdc6679f019952bbc1fed6a3b6c6b950a5b5ee73674bdf61078a42979ebdce55cc97276427b3abde3cb1dd872883b338fdf88855158a0301c1607d1cd5c294e

Malware Config

Targets

    • Target

      365ac8d843f9690a794710bfb8eeea25cc2abffc7d1098250ca73ebd4e9178ad

    • Size

      659KB

    • MD5

      5e516df77bc717bd4a412b775324d07b

    • SHA1

      eb81e16bbd27ee46a987f24933d37c65ffc5667b

    • SHA256

      365ac8d843f9690a794710bfb8eeea25cc2abffc7d1098250ca73ebd4e9178ad

    • SHA512

      dfdc6679f019952bbc1fed6a3b6c6b950a5b5ee73674bdf61078a42979ebdce55cc97276427b3abde3cb1dd872883b338fdf88855158a0301c1607d1cd5c294e

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v6

Tasks