General
-
Target
e6d6efece3b8baf2d0373c8adc270be90e9e6d48ffdf6c3253646075dd4c2fdc
-
Size
1.6MB
-
Sample
220520-3mq3sacagr
-
MD5
20d5d1903fe7b2f11ee6e0736f1d657d
-
SHA1
cb1a11d812cfe21a25f303ebfe127b2d93e912be
-
SHA256
e6d6efece3b8baf2d0373c8adc270be90e9e6d48ffdf6c3253646075dd4c2fdc
-
SHA512
d8765ba94b6945feceeb8af524cc529bcac805be5cbc47909b0ed57da8199190748a3cf5dcf8b0473c9d9b6caa570d0779ae7dad7811f44af9360e16e47b5568
Malware Config
Targets
-
-
Target
company letter_pdf_______________________________________.exe
-
Size
1.7MB
-
MD5
f013528fbca058469f52035d94bea1af
-
SHA1
28c80b4151a987f318d6faae6bf19d9566c3cc75
-
SHA256
b46571fd44360c7d8e9771a807c0914f419dc7dc69a43b475b537484a1aa5053
-
SHA512
a31622815b06eb2d22e6648d2fe540568ee571667170eda34d14344573fa5285cd548558e6ec67b9f094d930f65c2f19f7b4f97e60fa201a30278f33259b8905
Score10/10-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger log file
Detects a log file produced by MassLogger.
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-