Overview

overview

10

Static

static

Sample Inq...ef.exe

windows7_x64

10

Sample Inq...ef.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7c41514345f32542fb4e14e372bc1eacd408895e52340680758fb1b1cbaf0ad1

  • Size

    881KB

  • Sample

    220420-kyn4fsaebj

  • MD5

    f2fc275778e42a88f987c689c349ef4a

  • SHA1

    8940aedd296f23d7f67b8642a156152ba5bac799

  • SHA256

    7c41514345f32542fb4e14e372bc1eacd408895e52340680758fb1b1cbaf0ad1

  • SHA512

    92647fb89f11b936e9ce1ef444f18fb40c4642158446ebb2ef773bb6bff3c11966f4f1c8f9b3803e62dc8ae6874d0c5eb803dfd60128b04b3de484590af76225

Score
10/10
massloggercollectionspywarestealer

Malware Config

Targets

    • Target

      Sample Inquiry Ref.exe

    • Size

      1.1MB

    • MD5

      ea1885af97a055e92ac4ea6406df7a9b

    • SHA1

      443820d9e8783200bc85329496c071ea39a7a849

    • SHA256

      1c6f13d8f71f1a05425087658e39ea7460122b3bcbe94690d70003d76f7a120a

    • SHA512

      4e382682abee73ec37a857535b4fdca0e3bdba2c00aa954a5697913b456219765986be4b30dcc259fae864f16c86f3b76d01453ff70ea639dff9cb1a1aeb2cce

    Score
    10/10
    massloggercollectionspywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks