masslogger

General

Target

acabe30c464d9b9e59923068ebe3eeeb313b07b691f9ab442077b3fb5a751e35
Size

823KB
Sample

220520-31gfhacfhj
MD5

652c76dbea4397719a8ad4632adc916d
SHA1

fef56c478813a76ca302034daf684de2f3688f6b
SHA256

acabe30c464d9b9e59923068ebe3eeeb313b07b691f9ab442077b3fb5a751e35
SHA512

ba0c0fd16bf464500dad1c71da3ab14add78e5daebc5c9aaba43799ca88e01cc74ba3a5aee4d5c742ba8af91991f4b1b9d83f404aa384eb351d9fc2dd2104465

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\79FE0CC911\Log.txt

Family

masslogger

Ransom Note

<|| v2.4.0.0 ||> User Name: Admin IP: 154.61.71.51 Location: United States Windows OS: Microsoft Windows 7 Ultimate 64bit Windows Serial Key: D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 12:04:42 AM MassLogger Started: 5/21/2022 12:04:31 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\Repeat Order June InvoiceNew Inquiry.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: <|| WD Exclusion ||> Disabled <|| Binder ||> Disabled <|| Downloader ||> Disabled <|| Window Searcher ||> Disabled <|| Bot Killer ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> NA

Extracted

Path

C:\Users\Admin\AppData\Local\0F48153F20\Log.txt

Family

masslogger

Ransom Note

<|| v2.4.0.0 ||> User Name: Admin IP: 154.61.71.51 Location: United States Windows OS: Microsoft Windows 10 Pro 64bit Windows Serial Key: W269N-WFGWX-YVC9B-4J6C9-T83GX CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 12:04:37 AM MassLogger Started: 5/21/2022 12:04:34 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\Repeat Order June InvoiceNew Inquiry.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: <|| WD Exclusion ||> Disabled <|| Binder ||> Disabled <|| Downloader ||> Disabled <|| Window Searcher ||> Disabled <|| Bot Killer ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> NA

Targets

- Target
  
  Repeat Order June InvoiceNew Inquiry.exe
- Size
  
  1008KB
- MD5
  
  5924b147e462b108f46b4860ac014de1
- SHA1
  
  93576ab42760dacb58405a040bb99bf038cb7c58
- SHA256
  
  f4bf32943d6b14bf9e025c20f0fb7342982c025ba64b151687a99202091bf2eb
- SHA512
  
  38b672d2f8f5dc2accfdb0724d31181c3d33230090c55f2f483a48f14ecc5e815ae8962ef5064a24ee0aa98adf9d485f5a247520a43d99944468c23a8b98ecf4
Score

10^/10

masslogger collection ransomware spyware stealer
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger log file
  Detects a log file produced by MassLogger.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2