masslogger

General

Target

ef14c04357ab1b9fabd4f11d838b55dea45d9a900d4f0292b53150410d0e2677
Size

790KB
Sample

220521-bzx83scgc8
MD5

12aef547028e66473655d5324514e464
SHA1

2d6eb648467385b2ef19c6d9a9554fde179ee84c
SHA256

ef14c04357ab1b9fabd4f11d838b55dea45d9a900d4f0292b53150410d0e2677
SHA512

d99d54e180591ee2ff475268540a921b7f1aaf843f5da733817ba672e6684b47a3efd65f877e8b24424f613633c95c1a02a8f5f10e2c7a21810d94dbc6ce898b

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
[email protected]
Password:
whyworry1090#

Targets

- Target
  
  mpUN2haQz3Hh396.exe
- Size
  
  872KB
- MD5
  
  b616ebc834b650fee67ce3e99095dc6f
- SHA1
  
  c59a55cfb577b14589024ac0a34edcdb39d02c74
- SHA256
  
  f058f245d06f4d059132d2b9e90f84a332d0471ff0c421d49ca828d76874b8f3
- SHA512
  
  9b971064e009f3c52da0998fc31956bd3b156bb0a69447a1ef4960e54b4b145d8104b88b18b8a72a65b66cbd59445ec9210439e9b41a25b9cd919d15b9c11ee7
Score

10^/10

masslogger collection coreentity evasion rezer0 spyware stealer
- CoreEntity .NET Packer
  A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
  coreentity
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger log file
  Detects a log file produced by MassLogger.
- Looks for VirtualBox Guest Additions in registry
  evasion
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2