masslogger

General

Target

bca6c3c07f81609227d409a774879977b2ef095834ca88ccb4c8716269ca854f
Size

795KB
Sample

220521-b1dk3afhbj
MD5

fc0049b1f8d735e3e5ca153af43fc6e0
SHA1

db480ebfdbfb3616cfbb3f6d5025a0367ddda4af
SHA256

bca6c3c07f81609227d409a774879977b2ef095834ca88ccb4c8716269ca854f
SHA512

f02f0d235f4e289f8853a4d759881eeb937ddf91604a2de96d18599180b4053b49073360103235060b637e4aded216c7f7df605194c1d999f116daa550f651e7

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
[email protected]
Password:
NewBlessings

Targets

- Target
  
  SPECIFICATIONS.exe
- Size
  
  878KB
- MD5
  
  33c3551e8b1580ab7e9663b1c3e2c3f4
- SHA1
  
  6bd58b98d73b7d34487254354dcf07ec3a7b31e1
- SHA256
  
  ca946b7be994d2636254cb8b8cf44f5b7aa57fd705c6e07119aa4e68092daa01
- SHA512
  
  ff0eb8d158175c6f7cccb28791a4c090d5e047d9d792bd5bcf1e863d9e8d8adf0d2cbd3d89967d2d67b0de8b6ab496175a680c000fd1cf7a375ac7dd23cf5f72
Score

10^/10

coreentity evasion rezer0 masslogger collection spyware stealer
- CoreEntity .NET Packer
  A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
  coreentity
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger log file
  Detects a log file produced by MassLogger.
- Looks for VirtualBox Guest Additions in registry
  evasion
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2