masslogger

General

Target

b84e88b678f4f9984de9c8265b07e7dfdf1fce4d670df6444c9108ca11e74b47
Size

884KB
Sample

220521-cpwg6shcgm
MD5

d0872e890cef3c7638b2352ed6c456a6
SHA1

afbd85d59302f6d7df4ebf7ab66aeb86db8cf289
SHA256

b84e88b678f4f9984de9c8265b07e7dfdf1fce4d670df6444c9108ca11e74b47
SHA512

c8bd006c1d3adcc953d34ec22d32e737374cb088ca40f1beafd5005d7295769385cf87d06151a931d0b2a37d8c00718e6abd2c53b5501b2c608c0314e2c392a8

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\AEF946DCB4\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.5.0 ################################################################# ### Logger Details ### User Name: Admin IP: 127.0.0.1 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 5:24:16 AM MassLogger Started: 5/21/2022 5:23:47 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\Order.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\F95B724EDE\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.5.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 5:24:23 AM MassLogger Started: 5/21/2022 5:24:20 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\Order.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Targets

- Target
  
  Order.exe
- Size
  
  963KB
- MD5
  
  31e4fd5f285426f12f9797ed344358d4
- SHA1
  
  3a56f6e47b85c73e3d5318b369a1f731b76ea177
- SHA256
  
  c4a07dc8bc6223598106bdc7ad462c050f7da18c2756fccc8c56d14b1c2bd04c
- SHA512
  
  3c6cea185b38f5abf6e7c9635ab4456f55d8dec67c9f5d1b505a20ee9f18554a3ffb6bef9f0a5925d147bcd954f9101d2e0a9d2db85287111d9e0dbc0ad6b3ae
Score

10^/10

masslogger collection evasion ransomware rezer0 spyware stealer
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger Main Payload
- MassLogger log file
  Detects a log file produced by MassLogger.
- Modifies visibility of file extensions in Explorer
  evasion
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2