General

  • Target

    93f6f54f947d4f97f15eace1495a1ec562c60938c9fbc2901add9c6127629276

  • Size

    903KB

  • Sample

    220420-r3fffaadbr

  • MD5

    9ff55914a429876a254202522e019c3e

  • SHA1

    eec1afc3ea7464d0d321d05d49414f5789f0230a

  • SHA256

    93f6f54f947d4f97f15eace1495a1ec562c60938c9fbc2901add9c6127629276

  • SHA512

    0edb7f9b8817206403325a5759c5169e83417dcf3de89fb402f65e007c297e8118a7dd570b25c3109f0d1a10c1622c9bc51e565bedab440713c4ea2c2c0cb81a

Malware Config

Targets

    • Target

      93f6f54f947d4f97f15eace1495a1ec562c60938c9fbc2901add9c6127629276

    • Size

      903KB

    • MD5

      9ff55914a429876a254202522e019c3e

    • SHA1

      eec1afc3ea7464d0d321d05d49414f5789f0230a

    • SHA256

      93f6f54f947d4f97f15eace1495a1ec562c60938c9fbc2901add9c6127629276

    • SHA512

      0edb7f9b8817206403325a5759c5169e83417dcf3de89fb402f65e007c297e8118a7dd570b25c3109f0d1a10c1622c9bc51e565bedab440713c4ea2c2c0cb81a

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v6

Tasks