masslogger

General

Target

7494beb1fee29665bd22f4d346c00a5ffc443f55115d9bc4127144073f5213e4
Size

673KB
Sample

220521-c8wbhsfbg8
MD5

e5fa698a939d08c86c28e9c20a0d07c5
SHA1

86876e99ae61ad72e1428aa87157536fed0bc110
SHA256

7494beb1fee29665bd22f4d346c00a5ffc443f55115d9bc4127144073f5213e4
SHA512

060e8af7217b22f1703ab9051a0ca2460baf7fe43c3f870087a44ece0db8f58fce387eab01de71b541604a78191eba4123e771a1871d7889e69c1e509edd27dc

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\79FE0CC911\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v2.0.0.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States Windows OS: Microsoft Windows 7 Ultimate 64bit Windows Serial Key: D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 4:08:14 AM MassLogger Started: 5/21/2022 4:08:07 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\7xzfZF3ytRSjYKH.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Targets

- Target
  
  7xzfZF3ytRSjYKH.exe
- Size
  
  764KB
- MD5
  
  c1bc6e48612fc775cf6bdcb6cb037f87
- SHA1
  
  b02ccd068ac1120873abd28f1d9e356417bfbc11
- SHA256
  
  f98b35d218026beac9f13d886758bb0712fda3dc74ae7fbc5b29ce5fb63109ab
- SHA512
  
  9b98f89fb8d17dca762315bac8a4ad217d1f9984088f4e60d1307284e35cb3cae2eec6191f1b58fbeb7339405ea78e6d8bb082ce4f02663884c74e43aa24efdb
Score

10^/10

masslogger collection ransomware spyware stealer
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger log file
  Detects a log file produced by MassLogger.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2