masslogger

General

Target

7d83c6ac6e7997ac11249aadd8316ce23a684c40a92f17779eeae6de4ba6b27c
Size

643KB
Sample

220521-c5z6asfae5
MD5

9dd80a03e0d25e730278064cf06fbba8
SHA1

a56cf5411781a4428b5ab2e95627f466c83d0655
SHA256

7d83c6ac6e7997ac11249aadd8316ce23a684c40a92f17779eeae6de4ba6b27c
SHA512

3638c7a82220e6f18c64a958686a9a555c4afe274c1dd0d3802786a2a47c51d3bb2fcdabe3f4610bebdfd795c3a0b89d5ce499ea0908b2089c094637734248e9

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\3B8E3C2477\Log.txt

Family

masslogger

Ransom Note

<|| v2.1.0.0 ||> User Name: Admin IP: 154.61.71.50 Location: United States Windows OS: Microsoft Windows 7 Ultimate 64bit Windows Serial Key: D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 6:01:00 AM MassLogger Started: 5/21/2022 6:00:48 AM Interval: 96 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\ಪಾವತಿ ದೃ mation ೀಕರಣ ಸ್ಲಿಪ್ 07-24-20.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: <|| WD Exclusion ||> Disabled <|| Binder ||> Disabled <|| USB Spread ||> Disabled <|| Downloader ||> Disabled <|| Bot Killer ||> Disabled <|| Window Searcher ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> Disabled

Extracted

Path

C:\Users\Admin\AppData\Local\0F48153F20\Log.txt

Family

masslogger

Ransom Note

<|| v2.1.0.0 ||> User Name: Admin IP: 154.61.71.51 Location: United States Windows OS: Microsoft Windows 10 Pro 64bit Windows Serial Key: W269N-WFGWX-YVC9B-4J6C9-T83GX CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 4:00:28 AM MassLogger Started: 5/21/2022 4:00:25 AM Interval: 96 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\ಪಾವತಿ ದೃ mation ೀಕರಣ ಸ್ಲಿಪ್ 07-24-20.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: <|| WD Exclusion ||> Disabled <|| Binder ||> Disabled <|| USB Spread ||> Disabled <|| Downloader ||> Disabled <|| Window Searcher ||> Disabled <|| Bot Killer ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> Disabled

Targets

- Target
  
  ಪಾವತಿ ದೃ mation ೀಕರಣ ಸ್ಲಿಪ್ 07-24-20.exe
- Size
  
  750KB
- MD5
  
  0cb1ad8b32445eda194bf68aefd5f552
- SHA1
  
  4769df1335acbd13772622e503b7d751e029d659
- SHA256
  
  498155d460f7ffca4cd623b8de192d06298e3886700652db36e447739176104f
- SHA512
  
  1b5145938bbcdd27fe88bc30c066d0766fbe07fc4d241acb9d1d45890ce40bae877b1c083660e792f0699aa3855b91093105b77b4c6dcd2c303a440753e272e7
Score

10^/10

masslogger collection ransomware spyware stealer
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger log file
  Detects a log file produced by MassLogger.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2