masslogger

General

Target

e54d51089e6919d089bb8822aa217cb52c091e02e226ac77f44d1d3c6b00f30c
Size

952KB
Sample

220520-3mwy2acahp
MD5

9645a5b8524f8681957d374758ae4c47
SHA1

506082ba45f8519c413f0a60251e149c62b4e1fb
SHA256

e54d51089e6919d089bb8822aa217cb52c091e02e226ac77f44d1d3c6b00f30c
SHA512

6a841b014868e38d0bf6933e13a662fa9456f1991421b93bb209c55d24dc168f3848fc9c5b9f7e9fd3edb66f7f789138c3c42bc88266470b0f99f8eab8dd2227

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\8236ADF044\Log.txt

Family

masslogger

Ransom Note

<|| v2.1.0.0 ||> User Name: Admin IP: 127.0.0.1 Location: United States Windows OS: Microsoft Windows 10 Pro 64bit Windows Serial Key: W269N-WFGWX-YVC9B-4J6C9-T83GX CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 1:46:46 AM MassLogger Started: 5/21/2022 1:46:17 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\Purchase Order Sample.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: <|| WD Exclusion ||> Disabled <|| Downloader ||> Disabled <|| Binder ||> Disabled <|| USB Spread ||> Disabled <|| Window Searcher ||> Disabled <|| Bot Killer ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> NA

Extracted

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
[email protected]
Password:
08085892400

Targets

- Target
  
  Purchase Order Sample.exe
- Size
  
  1.1MB
- MD5
  
  62cab4e17234f2f9845bf22b71e39613
- SHA1
  
  e2ea503f6a6207c9fb3380a3e8533966616330f0
- SHA256
  
  f38a6d59735df60c2612686710b66c44a0042b7df2fe97e048fc6e480ce4848c
- SHA512
  
  5f5089905544946fd65efae11a5355ef62e868b5bacae13f08615d38f7c3bb673788610c6026b0e4d645a359d39447bbcba03510a11e731c54876eb18d147e4a
Score

10^/10

masslogger collection ransomware spyware stealer
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger log file
  Detects a log file produced by MassLogger.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2