Overview

overview

10

Static

static

21-7 air ?...df.exe

windows7_x64

10

21-7 air ?...df.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    44ed394e2f57716a9184cdf1c497331279c82bd5d3f9c544bb1bbe19f7df86c5

  • Size

    790KB

  • Sample

    220521-axsp5sdhhj

  • MD5

    9c7a270b24163f6a515e7bda1165618e

  • SHA1

    2a0ca40d66fbbd2be4713412d1ddf10654b59918

  • SHA256

    44ed394e2f57716a9184cdf1c497331279c82bd5d3f9c544bb1bbe19f7df86c5

  • SHA512

    5415154447ac9acffc93cdb0e2d785b4e73995c221e5f148ad49e8293902cbcb17427f4e8f29a7a261690cf40953fd240061cf356592c01729934e7dfafa509b

Score
10/10
massloggercollectionspywarestealer

Malware Config

Targets

    • Target

      21-7 air ??? AWB ??? ????.pdf.exe

    • Size

      950KB

    • MD5

      beb1f7f7ae08c302d5df6aece0ca2146

    • SHA1

      a088d4600b3c9573c92968e412c973a2981708d6

    • SHA256

      10eead56b5d7413b12b1fd1a4bf63dba2fa8995dad47d9a29577efd98264247a

    • SHA512

      0313b31697d435b8f8a0ae8d17cac7026a39532ce06b9cbb20caa8b4a6f23bfe05646449bacb29b4276276ec3893a9c3e1d6c1594c74ea0319ed31ef74dcf486

    Score
    10/10
    massloggercollectionspywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main Payload

    • MassLogger log file

      Detects a log file produced by MassLogger.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks