Overview

overview

10

Static

static

chibyke11.exe

windows7_x64

10

chibyke11.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    70b9faab5ed08bb8a13fd31713c698e18ca4f504055deae086ab1a9bf7007b47

  • Size

    722KB

  • Sample

    220420-rvzjcadde7

  • MD5

    2e207f4049944bb0ec93fcd07f04fc3a

  • SHA1

    5ad9a595bf6effc2a1c65dc4c8423fdd17416d37

  • SHA256

    70b9faab5ed08bb8a13fd31713c698e18ca4f504055deae086ab1a9bf7007b47

  • SHA512

    948703f45117a1eebdf6d953d557b75b56e3923c7221c89d9d9f050bdb8444efe065f247e0b7ed69f2c07b6645f0c6d61d5645d4f125d77a86d74c1d639d0725

Score
10/10
massloggercollectionspywarestealer

Malware Config

Targets

    • Target

      chibyke11.exe

    • Size

      1.1MB

    • MD5

      3c218b558b3074a2c0bae6564dc36a08

    • SHA1

      749820634368f1b9c4541c9269e69cf788d74f6a

    • SHA256

      1bdf22fa4a18737b696478210fe7a4eaf65fa8d1efffc82c675bd23efa8b938b

    • SHA512

      8bd595ce412a0e407001e0fcd91260c54c78595585fa00a5322459f53a9be6b7f5033f3953b101414f3f8c1691d604fd26172b7a283451cf57f721dc55c95f77

    Score
    10/10
    massloggercollectionspywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks