Overview

overview

10

Static

static

Inquriy List Ref.exe

windows7_x64

10

Inquriy List Ref.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7c96bb4d2f874c7042758088d7fd44e73c5e2616f5f78cc10b383e9ae9bacd5a

  • Size

    787KB

  • Sample

    220420-epjvgsfadq

  • MD5

    1236a5a71b37810d2d4468b6f67dd963

  • SHA1

    ff30e32eafb2938183dfb601b1db2e5f7f69d9d1

  • SHA256

    7c96bb4d2f874c7042758088d7fd44e73c5e2616f5f78cc10b383e9ae9bacd5a

  • SHA512

    6ab87d076d62335e63b620734ca1390f62f794e4a34c81528ca49af7b1f3dc35759a0dd22e9bafa7e1d6aeeaa4c4b3294438acba6f493d3c35223a765f9f12c0

Score
10/10
massloggercollectionspywarestealer

Malware Config

Targets

    • Target

      Inquriy List Ref.exe

    • Size

      897KB

    • MD5

      c0989fcd6a3bb3c463d4e6cf10bc2b78

    • SHA1

      26a804e261e9e5741858ebc475692d2c17a4ad42

    • SHA256

      18536d644a7be6098da4f895bac325297f0a4c08252f6b98f9cab510f004e8ce

    • SHA512

      9fbde9b86f9c9ba0ddd1ee227350294f69904a39a614b1d9ce810394771de8ad06f3033ace86059fe2fc8d42ef2d56e0c045760709a5bc80dea2dcdb9150f173

    Score
    10/10
    massloggercollectionspywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks