General

  • Target

    53b6af1e3ce13734da467d4578a33c7ddbf46733b3daa394bbe3848eedfc185e

  • Size

    2.5MB

  • Sample

    220418-t4jklafacq

  • MD5

    f6a6a736e40072da6930948938b5e719

  • SHA1

    cbd1e530d7c10b7d5bd34bb372d5d4e42c6f721a

  • SHA256

    53b6af1e3ce13734da467d4578a33c7ddbf46733b3daa394bbe3848eedfc185e

  • SHA512

    41381385d2519ab2d89e5861a09795254abae2c77d230fdcecd797951a9c5e5e15ab39956a0a83dc3e59cf8c4d74d77a317958673d86368dc94bdc9d00794baa

Malware Config

Targets

    • Target

      53b6af1e3ce13734da467d4578a33c7ddbf46733b3daa394bbe3848eedfc185e

    • Size

      2.5MB

    • MD5

      f6a6a736e40072da6930948938b5e719

    • SHA1

      cbd1e530d7c10b7d5bd34bb372d5d4e42c6f721a

    • SHA256

      53b6af1e3ce13734da467d4578a33c7ddbf46733b3daa394bbe3848eedfc185e

    • SHA512

      41381385d2519ab2d89e5861a09795254abae2c77d230fdcecd797951a9c5e5e15ab39956a0a83dc3e59cf8c4d74d77a317958673d86368dc94bdc9d00794baa

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v6

Tasks