Overview

overview

10

Static

static

ab0a502bd7...53.exe

windows7_x64

10

ab0a502bd7...53.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ab0a502bd72ea956ae55776e9ce491f5696d901eabfbbb10e99fd188f3ccf153

  • Size

    916KB

  • Sample

    220508-gtknpabhbp

  • MD5

    9fb349f53e2f2a3c9c4d861c2be9d34d

  • SHA1

    0a7b443d12c57959ae5197c58615d0cdd2f8e5c0

  • SHA256

    ab0a502bd72ea956ae55776e9ce491f5696d901eabfbbb10e99fd188f3ccf153

  • SHA512

    f1c5b31d61148372e17496a2ecea47abf955f0e76243c3470a8dd2a2c5faa55c440f87141a56638de22e25b1420f2b88c9c105bfe90fb040edb8279d61d2f224

Score
10/10
massloggercollectionspywarestealer

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.sivaafi.net
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    GXYGsI7G6~!T

Targets

    • Target

      ab0a502bd72ea956ae55776e9ce491f5696d901eabfbbb10e99fd188f3ccf153

    • Size

      916KB

    • MD5

      9fb349f53e2f2a3c9c4d861c2be9d34d

    • SHA1

      0a7b443d12c57959ae5197c58615d0cdd2f8e5c0

    • SHA256

      ab0a502bd72ea956ae55776e9ce491f5696d901eabfbbb10e99fd188f3ccf153

    • SHA512

      f1c5b31d61148372e17496a2ecea47abf955f0e76243c3470a8dd2a2c5faa55c440f87141a56638de22e25b1420f2b88c9c105bfe90fb040edb8279d61d2f224

    Score
    10/10
    massloggercollectionspywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks