General

  • Target

    9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3

  • Size

    63KB

  • Sample

    220512-n1rtxaddd8

  • MD5

    9568c589eb240860758e5b783bc1d379

  • SHA1

    694a7b0fac2c471da6306568efbce1e67199c91d

  • SHA256

    9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3

  • SHA512

    c3cd9401acebbd61804325678fff0af7f0522d6d5e5c30bc8eb2795644e7d5970b161174cd0e94dfd4a400a795cf1429d998fcdae6ca32ad2532d8ef60213c66

Malware Config

Targets

    • Target

      9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3

    • Size

      63KB

    • MD5

      9568c589eb240860758e5b783bc1d379

    • SHA1

      694a7b0fac2c471da6306568efbce1e67199c91d

    • SHA256

      9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3

    • SHA512

      c3cd9401acebbd61804325678fff0af7f0522d6d5e5c30bc8eb2795644e7d5970b161174cd0e94dfd4a400a795cf1429d998fcdae6ca32ad2532d8ef60213c66

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Command and Control

Web Service

1
T1102

Tasks