masslogger

General

Target

a0d80a5a4203d5855d8cd45a2c81b50d178ca4002c97c94a2268379992e6b16e
Size

1.1MB
Sample

220420-r2743adgf2
MD5

4f093f16fc0276a1d6ea8c4900f3a94d
SHA1

755dadb91b2d24b907ce92f47137f22fe5e8293b
SHA256

a0d80a5a4203d5855d8cd45a2c81b50d178ca4002c97c94a2268379992e6b16e
SHA512

af2dfc9c6b2c4090ba3b358c4cdce09a36c1ec225dd54bfb531dbde67f31b86377ca14babfcee7e3799ff1f6153830c2c2258c34087cfe9700697444e4ad0ab5

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\AEF946DCB4\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.3.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 4/20/2022 5:10:55 PM MassLogger Started: 4/20/2022 5:10:38 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe As Administrator: True

Extracted

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
[email protected]
Password:
Dmacdavid

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\781F780B4E\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.3.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 4/20/2022 3:09:12 PM MassLogger Started: 4/20/2022 3:09:09 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe As Administrator: True

Targets

- Target
  
  Consulta de productos.exe
- Size
  
  2.0MB
- MD5
  
  163f4507b66481d36fa511c0f056f20d
- SHA1
  
  30b2655b042043cea29b50ca9b418065b3223bdd
- SHA256
  
  8185bd02c507e6433d03c12e5f8b94b574d2f2ebb597e766563fd28295b5d681
- SHA512
  
  aab8a2bf8cd26e58e406a8497287f8c660e3489ea284e8f30d24093704e62c63b0bf82ec10fe9db130ec9d3a29680ebd23887d1c097b9c8473502d394017425f
Score

10^/10

masslogger collection ransomware spyware stealer
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger log file
  Detects a log file produced by MassLogger.
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2