masslogger

General

Target

a78ad842c6438e62ea79c6b9f25fbb6913149d38110405f8941697ebb1e80826
Size

559KB
Sample

220420-krkgpadfe6
MD5

73f277c453e39be57c7a8e501270b5c1
SHA1

2ffac2a3f62095609889918fca2330a5b6bfc228
SHA256

a78ad842c6438e62ea79c6b9f25fbb6913149d38110405f8941697ebb1e80826
SHA512

b606ade383d22a7f23b22a7a2f754175a52230a7e892ea4a3d4c62913f95e754929180a029a4f45f24b95ceee18c25cf2a4ea49e0733676d08b1ff52f95d13a7

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\79FE0CC911\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v2.0.0.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States Windows OS: Microsoft Windows 7 Ultimate 64bit Windows Serial Key: D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 4/20/2022 8:52:32 AM MassLogger Started: 4/20/2022 8:52:20 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\Zona Industrial.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Extracted

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
[email protected]
Password:
suckmydick22@

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\19E979543A\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v2.0.0.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.13 Location: United States Windows OS: Microsoft Windows 10 Pro 64bit Windows Serial Key: W269N-WFGWX-YVC9B-4J6C9-T83GX CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 4/20/2022 10:52:40 AM MassLogger Started: 4/20/2022 10:52:26 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\Zona Industrial.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Targets

- Target
  
  Zona Industrial.exe
- Size
  
  614KB
- MD5
  
  b19684558dec68ee45b19b99ff06244c
- SHA1
  
  90025801b69b7bfc7b6ccc231e3a767276aa164a
- SHA256
  
  ec8e1726c79994f38b1137b7652d7e31eea1ac4c9edc32ddb0888bb31b138fed
- SHA512
  
  6020a275d55dfbb2eba8b3c7cb8fedf97e3d1e7b647bd6b4ed1a9813f96269f187ba3f1bb2f5ece270a12ded8dee5ee7c8cedee4aecf0bac292b7b449744c306
Score

10^/10

masslogger collection ransomware spyware stealer
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger log file
  Detects a log file produced by MassLogger.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2