masslogger

General

Target

f487db26e46dc5067bca06003759d119dae50ff6c527a8c68fc01d73f41f4a64
Size

1.2MB
Sample

220520-1hvt3adhg2
MD5

93691c5a4445ff293229299f17d4c1f9
SHA1

d35793248343061d6b01718838de0023e8b20295
SHA256

f487db26e46dc5067bca06003759d119dae50ff6c527a8c68fc01d73f41f4a64
SHA512

a6bfd4e26771ad0e38ff20052cf9f3535185e4ec60d162a3c143f178ae679b55ff4d93b82a2b8e3a01937db4243af235d142ba9465288e34a79efc15b047b1e9

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\AEF946DCB4\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.4.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/20/2022 11:39:54 PM MassLogger Started: 5/20/2022 11:39:47 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\f487db26e46dc5067bca06003759d119dae50ff6c527a8c68fc01d73f41f4a64.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Targets

- Target
  
  f487db26e46dc5067bca06003759d119dae50ff6c527a8c68fc01d73f41f4a64
- Size
  
  1.2MB
- MD5
  
  93691c5a4445ff293229299f17d4c1f9
- SHA1
  
  d35793248343061d6b01718838de0023e8b20295
- SHA256
  
  f487db26e46dc5067bca06003759d119dae50ff6c527a8c68fc01d73f41f4a64
- SHA512
  
  a6bfd4e26771ad0e38ff20052cf9f3535185e4ec60d162a3c143f178ae679b55ff4d93b82a2b8e3a01937db4243af235d142ba9465288e34a79efc15b047b1e9
Score

10^/10

masslogger ransomware spyware stealer
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger Main Payload
- MassLogger log file
  Detects a log file produced by MassLogger.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

MassLogger Main Payload

MassLogger log file

Checks computer location settings

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2