General

  • Target

    7ae33c88444c868c904b1c7a7803caf98e4e395939c208bfa3a255dced82f83d

  • Size

    834KB

  • Sample

    220512-sw2krsdadk

  • MD5

    88bbe622fbf8eb6472d0920dd9bf3535

  • SHA1

    fb650922398f81dc01d93ec5506d540ef139305e

  • SHA256

    7ae33c88444c868c904b1c7a7803caf98e4e395939c208bfa3a255dced82f83d

  • SHA512

    0f1ab4e2117317914838e0936b1860e59d0cc19bb9c5b7791cf38b2f9d18a84f4bd346115921f31b6f484c5906e19a6e8e3261a105b9ff61aa9c0f2972973f40

Malware Config

Targets

    • Target

      7ae33c88444c868c904b1c7a7803caf98e4e395939c208bfa3a255dced82f83d

    • Size

      834KB

    • MD5

      88bbe622fbf8eb6472d0920dd9bf3535

    • SHA1

      fb650922398f81dc01d93ec5506d540ef139305e

    • SHA256

      7ae33c88444c868c904b1c7a7803caf98e4e395939c208bfa3a255dced82f83d

    • SHA512

      0f1ab4e2117317914838e0936b1860e59d0cc19bb9c5b7791cf38b2f9d18a84f4bd346115921f31b6f484c5906e19a6e8e3261a105b9ff61aa9c0f2972973f40

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks