masslogger

General

Target

68cfc485479b0e8c9d632ea389f3614e1c2ebd11fc79cc3075eaf005e361a155
Size

915KB
Sample

220521-apcnysaeg7
MD5

2abc5935096092a39ec4a696b39d9bb7
SHA1

12e3c83d0caf75a6221c9187cff8c3f44ba32b51
SHA256

68cfc485479b0e8c9d632ea389f3614e1c2ebd11fc79cc3075eaf005e361a155
SHA512

7f32125fbc92a347bf8a486679631a7336a77607588e4629e8c8b872f8513d5a3264ce6e4e82735a407371b3301b9c7849b39ba3ec43533d79ed790f6a3bb3af

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\79FE0CC911\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.6.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States Windows OS: Microsoft Windows 7 Ultimate 64bit Windows Serial Key: D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 12:37:30 AM MassLogger Started: 5/21/2022 12:37:23 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\inquiry specification.exe MassLogger Melt: false MassLogger Exit after delivery: true As Administrator: True Processes:

Extracted

Credentials

Protocol: smtp
Host:
mail.samlogistics.pk
Port:
587
Username:
[email protected]
Password:
Seaimport121@

Targets

- Target
  
  inquiry specification.exe
- Size
  
  1.1MB
- MD5
  
  16c4321bc234cdab8a4d88ab7ec34dce
- SHA1
  
  5d14eca7122d63f168dda48f6d93cdc74493d265
- SHA256
  
  18e55619cb6c0b70275af3562d71f362114ac432ec97fbcd4ad8425113f6471a
- SHA512
  
  d3d5277cdcca9c99a3a797bb0bbf68f2fcdf41efef540e5c445006ec2893bd6c240e620efd78ebe559f608d6423e03d57e161ca03da5e618f4a95a288e368c2a
Score

10^/10

masslogger collection evasion ransomware spyware stealer
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger Main Payload
- MassLogger log file
  Detects a log file produced by MassLogger.
- Modifies visibility of file extensions in Explorer
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2