General
-
Target
d33ee6619b671295dfd9a8599eff6bfba63f4b71811d1c304e0132caa36543bc
-
Size
485KB
-
Sample
220521-chxfwshaak
-
MD5
db93b9c0edb07b840e95fd5fdbfb0951
-
SHA1
1d017bed1e231bca5e887c623a12438d0f5f9f51
-
SHA256
d33ee6619b671295dfd9a8599eff6bfba63f4b71811d1c304e0132caa36543bc
-
SHA512
9b1e06631929648ab1d6c0c00c0678d687ea5da0f4ccf12babee78e42437eda8fb5fa5520696ad281b5a692e2c27e6fd7f1609e63fb2f2aca179b8eb7d082b1e
Static task
static1
Behavioral task
behavioral1
Sample
img_0933.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
img_0933.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt
masslogger
Extracted
C:\Users\Admin\AppData\Local\781F780B4E\Log.txt
masslogger
Targets
-
-
Target
img_0933.exe
-
Size
1.4MB
-
MD5
f8d0bab3e3367fbd94c1f82eb33714e7
-
SHA1
e457ae2ad469dd932300a02a4e3b9c03010d5e31
-
SHA256
cc6b0848a3a848c9ee7ce3f63d1e3f95393f6593140e2aab400146c06e593793
-
SHA512
0064460f534399a26e4dd2e29804c3f8b7cd3d8b97808a9ae713c6e7eed0facd621ed3d98f3dad1b655ed051e069fbb9e513b1d51d0ccf61bfde30f668c65784
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload
-
MassLogger log file
Detects a log file produced by MassLogger.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-