masslogger

General

Target

48d9cb77f8ed388bfccf2d12b6f10f60c69d14b8559f5d545d31e443635e465f
Size

730KB
Sample

220516-qawfhscfa4
MD5

2de9afcc1fbcca2ec17df764daad2ec4
SHA1

7e0f715ef2f1a54de703c784ac1889707c1749e5
SHA256

48d9cb77f8ed388bfccf2d12b6f10f60c69d14b8559f5d545d31e443635e465f
SHA512

7046c17deae26114c1325cbf30cfb8e10f0c291c8b0d3253101ce33b04ad5e81b0100828ffa29f255288fbe6137de12ed799f185cd554f3afc4e916c7a23fce6

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\79FE0CC911\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v2.0.0.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States Windows OS: Microsoft Windows 7 Ultimate 64bit Windows Serial Key: D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/16/2022 2:40:35 PM MassLogger Started: 5/16/2022 2:40:25 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\48d9cb77f8ed388bfccf2d12b6f10f60c69d14b8559f5d545d31e443635e465f.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Extracted

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
[email protected]
Password:
@Mexico1.,

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\8236ADF044\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v2.0.0.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States Windows OS: Microsoft Windows 10 Pro 64bit Windows Serial Key: W269N-WFGWX-YVC9B-4J6C9-T83GX CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/16/2022 4:40:39 PM MassLogger Started: 5/16/2022 4:40:35 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\48d9cb77f8ed388bfccf2d12b6f10f60c69d14b8559f5d545d31e443635e465f.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Targets

- Target
  
  48d9cb77f8ed388bfccf2d12b6f10f60c69d14b8559f5d545d31e443635e465f
- Size
  
  730KB
- MD5
  
  2de9afcc1fbcca2ec17df764daad2ec4
- SHA1
  
  7e0f715ef2f1a54de703c784ac1889707c1749e5
- SHA256
  
  48d9cb77f8ed388bfccf2d12b6f10f60c69d14b8559f5d545d31e443635e465f
- SHA512
  
  7046c17deae26114c1325cbf30cfb8e10f0c291c8b0d3253101ce33b04ad5e81b0100828ffa29f255288fbe6137de12ed799f185cd554f3afc4e916c7a23fce6
Score

10^/10

masslogger collection ransomware spyware stealer
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger log file
  Detects a log file produced by MassLogger.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2