General

  • Target

    0735c38405324286ad13b2201cd42e408ea6ebcf2bdc48a892deee64b4942514

  • Size

    2.6MB

  • Sample

    220418-pwe5zsfgbk

  • MD5

    d97cb3172bbed020ee0dc30896277895

  • SHA1

    1f0c127cb610209eced31951c3b9a8b9c3767615

  • SHA256

    0735c38405324286ad13b2201cd42e408ea6ebcf2bdc48a892deee64b4942514

  • SHA512

    1f81a260af84056f706a056e0ed089be99993364ab9e9973b1c7becc1a7216aea56cef75571b1f0187425b3db4260c74f780d481dc65f7409d4cf8b6c0f9dcf6

Malware Config

Targets

    • Target

      0735c38405324286ad13b2201cd42e408ea6ebcf2bdc48a892deee64b4942514

    • Size

      2.6MB

    • MD5

      d97cb3172bbed020ee0dc30896277895

    • SHA1

      1f0c127cb610209eced31951c3b9a8b9c3767615

    • SHA256

      0735c38405324286ad13b2201cd42e408ea6ebcf2bdc48a892deee64b4942514

    • SHA512

      1f81a260af84056f706a056e0ed089be99993364ab9e9973b1c7becc1a7216aea56cef75571b1f0187425b3db4260c74f780d481dc65f7409d4cf8b6c0f9dcf6

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v6

Tasks