masslogger

General

Target

81ab4f76e1157ed9509e7615027baaa74070704be460d093b4f193ad976f683a
Size

791KB
Sample

220521-c4w29afaa8
MD5

e165032e0c340c98d823d7d40c154aac
SHA1

0b58808d2c5fc659ae4512ff3aef896d82476f86
SHA256

81ab4f76e1157ed9509e7615027baaa74070704be460d093b4f193ad976f683a
SHA512

d6cbfecaef1984c7f0b19978dcbd72ab862ecbbb531e43e5552d2c0a341076d1d342813ce4c2962497ae4b40e3f2e031b09e2ad2f4e82c9d1e3530b2094e7565

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\AEF946DCB4\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.3.0 ################################################################# ### Logger Details ### User Name: Admin IP: 127.0.0.1 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 5:56:56 AM MassLogger Started: 5/21/2022 5:56:30 AM Interval: 2 hour MassLogger Process: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe As Administrator: True

Extracted

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
[email protected]
Password:
1234567890

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\F293CD6622\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.3.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 5:56:45 AM MassLogger Started: 5/21/2022 5:56:28 AM Interval: 2 hour MassLogger Process: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe As Administrator: True

Targets

- Target
  
  Inquiry For Order Confirmation.exe
- Size
  
  852KB
- MD5
  
  ca3d1f78f33139c641cc120f2308e5e8
- SHA1
  
  71df8438202c96de30505abde4674ef9502f7fe6
- SHA256
  
  1793f187d699d6b5eac0451dc8740943f1622a4ce989e7d8d03fef4976564b1b
- SHA512
  
  0d30db1915b7e45c920220e83ea7df31cd7aaaf88baa86b72e6fa306dbe409a6fe8a6fcd2ab0863e599222af88c2a86c3fc4574df96ae6c5642ee31fff9958a2
Score

10^/10

masslogger collection coreentity ransomware rezer0 spyware stealer
- CoreEntity .NET Packer
  A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
  coreentity
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger log file
  Detects a log file produced by MassLogger.
- CoreCCC Packer
  Detects CoreCCC packer used to load .NET malware.
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2