General

  • Target

    111a7b2a945aafa253488cc4eb0ecdd7f944f27685f26c9ce18c60d34bb7c4f2

  • Size

    958KB

  • Sample

    220502-sy8f4aagar

  • MD5

    a948b1aa4d7862676cf27fbcafc2f443

  • SHA1

    c7f90b9ef9c0bda438e8db7e727ea454558d464e

  • SHA256

    111a7b2a945aafa253488cc4eb0ecdd7f944f27685f26c9ce18c60d34bb7c4f2

  • SHA512

    fe5456ac05bae06af709f5d31c1620259fd0c02e41b464208f82c861c3d2a096be60acbe4a9592d04ae6faac460a002d2aa69fdc194467c333124238ee3b2f6f

Malware Config

Targets

    • Target

      111a7b2a945aafa253488cc4eb0ecdd7f944f27685f26c9ce18c60d34bb7c4f2

    • Size

      958KB

    • MD5

      a948b1aa4d7862676cf27fbcafc2f443

    • SHA1

      c7f90b9ef9c0bda438e8db7e727ea454558d464e

    • SHA256

      111a7b2a945aafa253488cc4eb0ecdd7f944f27685f26c9ce18c60d34bb7c4f2

    • SHA512

      fe5456ac05bae06af709f5d31c1620259fd0c02e41b464208f82c861c3d2a096be60acbe4a9592d04ae6faac460a002d2aa69fdc194467c333124238ee3b2f6f

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks