General

  • Target

    68dde9189f9908b3ae89d17df74459367fa3a22de1a9baf1426f5384f6a6c83c

  • Size

    962KB

  • Sample

    220420-f7rtgsdcb2

  • MD5

    a45b5331745c5eeb129b12aec82873e8

  • SHA1

    db18b7c9642801f2ceede98250d72c9119637984

  • SHA256

    68dde9189f9908b3ae89d17df74459367fa3a22de1a9baf1426f5384f6a6c83c

  • SHA512

    2785a00e29a0f65898f59317a6eca519a4715257894493e40c3d5ca948ad94a6e0c58f80e645ab9539d39a5e9e72296f789586c939f7233e749f96f7ff7e7035

Malware Config

Targets

    • Target

      68dde9189f9908b3ae89d17df74459367fa3a22de1a9baf1426f5384f6a6c83c

    • Size

      962KB

    • MD5

      a45b5331745c5eeb129b12aec82873e8

    • SHA1

      db18b7c9642801f2ceede98250d72c9119637984

    • SHA256

      68dde9189f9908b3ae89d17df74459367fa3a22de1a9baf1426f5384f6a6c83c

    • SHA512

      2785a00e29a0f65898f59317a6eca519a4715257894493e40c3d5ca948ad94a6e0c58f80e645ab9539d39a5e9e72296f789586c939f7233e749f96f7ff7e7035

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v6

Tasks