masslogger

General

Target

bc6a63b07a18d95278dee0e0d77c1e91d4a80bfca9732f030ce069894f610b14
Size

920KB
Sample

220515-1dz8zsgbc2
MD5

a7f29df168c669851c1979dbc41c95b2
SHA1

46d9da6397c063544cdd8dc9b9f8a65142aefa40
SHA256

bc6a63b07a18d95278dee0e0d77c1e91d4a80bfca9732f030ce069894f610b14
SHA512

79c92ba1352bff8f8f705b325a91196c867d45939ecf2bafac386c192637990d8a212d52b31bfb249794c28c1d1bee0c663ba827983b2fbb803271ca3446d0c6

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\3B8E3C2477\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.4.0 ################################################################# ### Logger Details ### User Name: Admin IP: 127.0.0.1 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/15/2022 11:36:58 PM MassLogger Started: 5/15/2022 11:36:19 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\bc6a63b07a18d95278dee0e0d77c1e91d4a80bfca9732f030ce069894f610b14.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Targets

- Target
  
  bc6a63b07a18d95278dee0e0d77c1e91d4a80bfca9732f030ce069894f610b14
- Size
  
  920KB
- MD5
  
  a7f29df168c669851c1979dbc41c95b2
- SHA1
  
  46d9da6397c063544cdd8dc9b9f8a65142aefa40
- SHA256
  
  bc6a63b07a18d95278dee0e0d77c1e91d4a80bfca9732f030ce069894f610b14
- SHA512
  
  79c92ba1352bff8f8f705b325a91196c867d45939ecf2bafac386c192637990d8a212d52b31bfb249794c28c1d1bee0c663ba827983b2fbb803271ca3446d0c6
Score

10^/10

masslogger coreentity ransomware rezer0 spyware stealer
- CoreEntity .NET Packer
  A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
  coreentity
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger log file
  Detects a log file produced by MassLogger.
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

CoreEntity .NET Packer

MassLogger log file

ReZer0 packer

Checks computer location settings

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2