General

  • Target

    04bfa002e548345b247cecc437e66964119db3c5d5b5efabed32211196ba8043

  • Size

    1006KB

  • Sample

    220420-kqtc7saaen

  • MD5

    02aa43bf507664344eecd119caba890e

  • SHA1

    fb6ca9e26a7d05f1ece85c0833b3c8b3dce98387

  • SHA256

    04bfa002e548345b247cecc437e66964119db3c5d5b5efabed32211196ba8043

  • SHA512

    05ba45f68eafb2ba78ed3a89d8c4ba415a84eafd3d4951ff7cc86295ce9ab038d1a8a287bb0892850c64212316d9093cfa158510ff9b3d88442c95527d5f19f9

Malware Config

Targets

    • Target

      04bfa002e548345b247cecc437e66964119db3c5d5b5efabed32211196ba8043

    • Size

      1006KB

    • MD5

      02aa43bf507664344eecd119caba890e

    • SHA1

      fb6ca9e26a7d05f1ece85c0833b3c8b3dce98387

    • SHA256

      04bfa002e548345b247cecc437e66964119db3c5d5b5efabed32211196ba8043

    • SHA512

      05ba45f68eafb2ba78ed3a89d8c4ba415a84eafd3d4951ff7cc86295ce9ab038d1a8a287bb0892850c64212316d9093cfa158510ff9b3d88442c95527d5f19f9

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v6

Tasks