Overview

overview

10

Static

static

ADKA INQ.exe

windows7_x64

10

ADKA INQ.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    39c997230b03f22639eb7825ec76cedcfd36021f1d1dea821ffb714e42e8b4ce

  • Size

    1.2MB

  • Sample

    220520-3dctssgff4

  • MD5

    6007002bf4503a463801d52ec61108d1

  • SHA1

    c22d2e42c3997d7838d3fd49bfd793a615c7e6e4

  • SHA256

    39c997230b03f22639eb7825ec76cedcfd36021f1d1dea821ffb714e42e8b4ce

  • SHA512

    4da2e8c96b0c277597b52fbc27d8a3bf1bfb7c6f505c7ab6b53795516057ddecf665e8c133b8fd21d2feffac84be106ddc8e20a1393900a70ca7dccc41f41dee

Score
10/10
massloggeragilenetcollectionransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\3B8E3C2477\Log.txt

Family

masslogger

Ransom Note
################################################################# MassLogger v1.3.3.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 1:27:39 AM MassLogger Started: 5/21/2022 1:27:18 AM Interval: 2 hour MassLogger Process: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe As Administrator: True

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Dmacdavid

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\2EF8342664\Log.txt

Family

masslogger

Ransom Note
################################################################# MassLogger v1.3.3.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 1:27:05 AM MassLogger Started: 5/21/2022 1:27:00 AM Interval: 2 hour MassLogger Process: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe As Administrator: True

Targets

    • Target

      ADKA INQ.exe

    • Size

      2.3MB

    • MD5

      97910a5d5c39a191f4fb1cc62a1f543d

    • SHA1

      fb72e8a7b1a5470312ab6f618677758e90f0049f

    • SHA256

      b4e5394cabb090592d987c1ee9bbee93b2f4aeb907cbbb70b62554f1bfc773eb

    • SHA512

      ab308cb7bfd848a9e1a44f5dd97affa72e25b0cbaad3fe4cf516c2b476da005e9859576360e27e512194da4b49989c049cd6f19e86a41d4a2b853e94b5796e30

    Score
    10/10
    massloggeragilenetcollectionransomwarespywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger log file

      Detects a log file produced by MassLogger.

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks