masslogger

General

Target

2909694b162fb67f8b7d6f01bdb086d23216280a1f84565a13a4406ac46147c3
Size

673KB
Sample

220520-2zx67abcdq
MD5

2fb78b099edc88207a4dbcfa8b6a44e0
SHA1

4c7a556c5d7373bee762c51c716a548d6f6a4974
SHA256

2909694b162fb67f8b7d6f01bdb086d23216280a1f84565a13a4406ac46147c3
SHA512

01569acb98ebf4aa45b8a79362501d1d6fcb4b7baf29b4b9e9eed1166228b73cc68ffadc83730f2921d836153141eddc9ff8c04d9152512c0943eeca5d68488c

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\AEF946DCB4\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.6.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States Windows OS: Microsoft Windows 7 Ultimate 64bit Windows Serial Key: D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 1:14:39 AM MassLogger Started: 5/21/2022 1:14:28 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\RegAsm.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: Name:WerFault, Title:Z/z8qH7&G(y2x4)YLm

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\F293CD6622\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.6.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States Windows OS: Microsoft Windows 10 Pro64bit Windows Serial Key: W269N-WFGWX-YVC9B-4J6C9-T83GX CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 1:15:18 AM MassLogger Started: 5/21/2022 1:15:11 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\RegAsm.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Targets

- Target
  
  doc000643665764.exe
- Size
  
  1.4MB
- MD5
  
  e04ea3820e1699eb0cce1ddb55b91327
- SHA1
  
  736ab206d9bba71557069b42b05b7615b28e5b0f
- SHA256
  
  367c31b38577406fec107ed639cc6503710de53d8326b92504fd3919105ffce9
- SHA512
  
  64926a6671e9b90a69ffb64f61ae48d59fc61834a5083ae1ad119af711ef04923dfc607ace4bdd4ab2c06e495ee1b84f0399dc0df54b847d201d6770c864167c
Score

10^/10

masslogger persistence ransomware spyware stealer collection
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger Main Payload
- MassLogger log file
  Detects a log file produced by MassLogger.
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2