General

  • Target

    f46e28c7a2557f41f0d572d066113bbeb7550b860cd64cf4f977ac1116623187

  • Size

    928KB

  • Sample

    220521-b93ljsgeeq

  • MD5

    66b0b62b935d3d78be5a749ea8004d21

  • SHA1

    e33d4c4ad90b7f07e38921594a93cb2f19d38b0f

  • SHA256

    f46e28c7a2557f41f0d572d066113bbeb7550b860cd64cf4f977ac1116623187

  • SHA512

    d424bec0c5b47817343f9975e167e0f2a0a259af66ebef624f114042f1316f4b77ebd20aadb42123953eee58f08805f31974c5729aa4fe989bf998204356aec6

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\8506BBE7FF\Log.txt

Family

masslogger

Ransom Note
################################################################# MassLogger v1.3.6.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.13 Location: United States Windows OS: Microsoft Windows 7 Ultimate 64bit Windows Serial Key: D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 4:47:56 AM MassLogger Started: 5/21/2022 4:47:34 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\AOS Neptune_028E.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\0F48153F20\Log.txt

Family

masslogger

Ransom Note
################################################################# MassLogger v1.3.6.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States Windows OS: Microsoft Windows 10 Pro64bit Windows Serial Key: W269N-WFGWX-YVC9B-4J6C9-T83GX CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 2:47:47 AM MassLogger Started: 5/21/2022 2:47:44 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\AOS Neptune_028E.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    y8wG[wgBvT]F

Targets

    • Target

      AOS Neptune_028E.exe

    • Size

      868KB

    • MD5

      6113ddc1b5a8d0984b259768fa03a681

    • SHA1

      269592ed330417b87d325174e1a6ae180b0a4243

    • SHA256

      cc9cd3fab00a7ca68c26cbf9bfcf691aafd004232149c04d2d082a1fe06b9f32

    • SHA512

      7ef9de0d9952af32c408040920cb94445b4c166d33a8c25247cd28b75bce6360511f7fdc0954082f43202e2ba9bf0c1ba448df67876808c949c016d08c19e289

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger Main Payload

    • MassLogger log file

      Detects a log file produced by MassLogger.

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks