General

  • Target

    05d6ceb92d47903601cea45da9d80f2f76a61ff735a7f9c305f1b2c59be8d726

  • Size

    2.6MB

  • Sample

    220418-t8k9zsafe3

  • MD5

    99dcbbcb4ffcef881567b46dcd195e28

  • SHA1

    b59828482085080bcd9a542718ce24633b197fd5

  • SHA256

    05d6ceb92d47903601cea45da9d80f2f76a61ff735a7f9c305f1b2c59be8d726

  • SHA512

    c3885756a513c604aac6755a17b2155d6273a095b02c8e9a5a108978d4a3d221d8218758a9eeaa44ff186138b8e14257f8eed021afa0678440a825d7dea10fe6

Malware Config

Targets

    • Target

      05d6ceb92d47903601cea45da9d80f2f76a61ff735a7f9c305f1b2c59be8d726

    • Size

      2.6MB

    • MD5

      99dcbbcb4ffcef881567b46dcd195e28

    • SHA1

      b59828482085080bcd9a542718ce24633b197fd5

    • SHA256

      05d6ceb92d47903601cea45da9d80f2f76a61ff735a7f9c305f1b2c59be8d726

    • SHA512

      c3885756a513c604aac6755a17b2155d6273a095b02c8e9a5a108978d4a3d221d8218758a9eeaa44ff186138b8e14257f8eed021afa0678440a825d7dea10fe6

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v6

Tasks