General

  • Target

    6f1276174813e960a88fc24b008d1263b87ef1a6165e8f54883536ae389d736d

  • Size

    886KB

  • Sample

    220420-cn7h2sdcdm

  • MD5

    af3e67d0dd587624470d4fcf81955f8f

  • SHA1

    829f8e110291da33cc98cb64e037bb74743c7bde

  • SHA256

    6f1276174813e960a88fc24b008d1263b87ef1a6165e8f54883536ae389d736d

  • SHA512

    b48c8d205c73d8bfb120d9b3e5d9b31c9215b70bc295da35451b20ba60b2cafaf1bad56dd99d2fddfa9195506dbf6ef15adfba135fa13dd1cdbaadc766c88431

Malware Config

Targets

    • Target

      6f1276174813e960a88fc24b008d1263b87ef1a6165e8f54883536ae389d736d

    • Size

      886KB

    • MD5

      af3e67d0dd587624470d4fcf81955f8f

    • SHA1

      829f8e110291da33cc98cb64e037bb74743c7bde

    • SHA256

      6f1276174813e960a88fc24b008d1263b87ef1a6165e8f54883536ae389d736d

    • SHA512

      b48c8d205c73d8bfb120d9b3e5d9b31c9215b70bc295da35451b20ba60b2cafaf1bad56dd99d2fddfa9195506dbf6ef15adfba135fa13dd1cdbaadc766c88431

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks