General
-
Target
9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3
-
Size
63KB
-
Sample
220512-n1rtxaddd8
-
MD5
9568c589eb240860758e5b783bc1d379
-
SHA1
694a7b0fac2c471da6306568efbce1e67199c91d
-
SHA256
9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3
-
SHA512
c3cd9401acebbd61804325678fff0af7f0522d6d5e5c30bc8eb2795644e7d5970b161174cd0e94dfd4a400a795cf1429d998fcdae6ca32ad2532d8ef60213c66
Static task
static1
Behavioral task
behavioral1
Sample
9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe
Resource
win10v2004-20220414-en
Malware Config
Targets
-
-
Target
9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3
-
Size
63KB
-
MD5
9568c589eb240860758e5b783bc1d379
-
SHA1
694a7b0fac2c471da6306568efbce1e67199c91d
-
SHA256
9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3
-
SHA512
c3cd9401acebbd61804325678fff0af7f0522d6d5e5c30bc8eb2795644e7d5970b161174cd0e94dfd4a400a795cf1429d998fcdae6ca32ad2532d8ef60213c66
Score10/10-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Accesses Microsoft Outlook profiles
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-