Overview

overview

10

Static

static

20dd4b0c60...59.exe

windows7_x64

6

20dd4b0c60...59.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    20dd4b0c600a054cd77d5a393ac9f48e708436de439c0a4a8bac17794ad62b59

  • Size

    1.3MB

  • Sample

    220502-sy1fgsagak

  • MD5

    1878ea8aa9def576b7b226155ca0927a

  • SHA1

    57555bd15be5591701dff0bd66602b7973e6d151

  • SHA256

    20dd4b0c600a054cd77d5a393ac9f48e708436de439c0a4a8bac17794ad62b59

  • SHA512

    60748bc6d8b36530953f29afb92a9755d03a1ad5b611ccc23cf5d6466f9e5a292a841b81ca8fac278c3a5cad79f19e4bdb6b813cc9178c803bcbd2ba4339a9ac

Score
10/10
massloggerpersistencespywarestealer

Malware Config

Targets

    • Target

      20dd4b0c600a054cd77d5a393ac9f48e708436de439c0a4a8bac17794ad62b59

    • Size

      1.3MB

    • MD5

      1878ea8aa9def576b7b226155ca0927a

    • SHA1

      57555bd15be5591701dff0bd66602b7973e6d151

    • SHA256

      20dd4b0c600a054cd77d5a393ac9f48e708436de439c0a4a8bac17794ad62b59

    • SHA512

      60748bc6d8b36530953f29afb92a9755d03a1ad5b611ccc23cf5d6466f9e5a292a841b81ca8fac278c3a5cad79f19e4bdb6b813cc9178c803bcbd2ba4339a9ac

    Score
    10/10
    persistencemassloggerspywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main Payload

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks