General

  • Target

    3c407667b6f2f4d37a823737a871b61a31d9269fafeb9197c72e04e0591f6897

  • Size

    1.2MB

  • Sample

    220420-eqcskafagn

  • MD5

    f0459ea78912ae96a3b503e483db6ce5

  • SHA1

    782aa3b2d3ec604627e4ed8174bd63b5df876d22

  • SHA256

    3c407667b6f2f4d37a823737a871b61a31d9269fafeb9197c72e04e0591f6897

  • SHA512

    b266b8286852d7d9ad063fdf19d05ea35d0b38b788de7141ca950c7fdc4f2aacb04748278e04b5ecbe8474af88308494b0fd97cc2a55efbc880c868b91b43554

Malware Config

Targets

    • Target

      3c407667b6f2f4d37a823737a871b61a31d9269fafeb9197c72e04e0591f6897

    • Size

      1.2MB

    • MD5

      f0459ea78912ae96a3b503e483db6ce5

    • SHA1

      782aa3b2d3ec604627e4ed8174bd63b5df876d22

    • SHA256

      3c407667b6f2f4d37a823737a871b61a31d9269fafeb9197c72e04e0591f6897

    • SHA512

      b266b8286852d7d9ad063fdf19d05ea35d0b38b788de7141ca950c7fdc4f2aacb04748278e04b5ecbe8474af88308494b0fd97cc2a55efbc880c868b91b43554

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks