masslogger

General

Target

d0a266b4b689590e572020b8117157cdfa05d9b6d9cbcdb0aa5389ab3d55cfa6
Size

920KB
Sample

220521-cjgrtshacj
MD5

c8a43aca750f1bd180abfd1a2e21c440
SHA1

92da2b84a69eee0e015d1031f0af998014db7827
SHA256

d0a266b4b689590e572020b8117157cdfa05d9b6d9cbcdb0aa5389ab3d55cfa6
SHA512

01172c73bbf0d64a3cf64cb1bfdcd81f23b10a24515d0c586e8c0aa22a7c6242f55685fa9877fa9d96e747c0dc5dc120f780c8b1454c7db0ed8a4cf610d75554

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\AEF946DCB4\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.5.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 5:09:16 AM MassLogger Started: 5/21/2022 5:09:05 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\BIS SWIFT_20072020_9427492749242_PDF.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Extracted

Credentials

Protocol: smtp
Host:
smtp.yandex.ru
Port:
587
Username:
[email protected]
Password:
whayasaynewnew

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\F95B724EDE\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.5.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 5:08:56 AM MassLogger Started: 5/21/2022 5:08:53 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\BIS SWIFT_20072020_9427492749242_PDF.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Targets

- Target
  
  BIS SWIFT_20072020_9427492749242_PDF.exe
- Size
  
  859KB
- MD5
  
  eaa16f260cb00d0af4d9185afe4229ad
- SHA1
  
  0e24ae315d10be3bb2b6381fb8dd5236aa15bf5a
- SHA256
  
  4ec1d73b11767e3b5dd254e25b0614cd4b8031db95d9677ecbbd53e0eea9c4de
- SHA512
  
  aae1dce4c5ad629de0ac851fed60c0ff38e6c6c1665e0aa493c02b07832771e9ea794d492e9e6aeb60328a8975e8b8b0b9e1694ea6156966ae55ca54a0cf437e
Score

10^/10

masslogger collection ransomware spyware stealer
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger Main Payload
- MassLogger log file
  Detects a log file produced by MassLogger.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2