Overview

overview

10

Static

static

Purchase Order.exe

windows7_x64

10

Purchase Order.exe

windows10-2004_x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b7011f3192d7bc46c212b4c2053f928e0799c27d41761fc49706460f85f70813

  • Size

    1.0MB

  • Sample

    220521-cqeaaahdam

  • MD5

    4297c17b5b2faa64159f86a54853f66e

  • SHA1

    2dec79fd4320aff8e9259268d35c17265dc94681

  • SHA256

    b7011f3192d7bc46c212b4c2053f928e0799c27d41761fc49706460f85f70813

  • SHA512

    c4b2a9b574414d4f05f8db3f11e1f7eab36c61c2f7dcd3342c78996fe45c648acbad8299c1f39565e23632d459e929f39039d1ba694977bcc9992a47adfec21e

Score
10/10
massloggercollectionspywarestealer

Malware Config

Targets

    • Target

      Purchase Order.exe

    • Size

      1.2MB

    • MD5

      f4ddb56c284c138c43bd6f4465a557e9

    • SHA1

      28378fcacd7a172487f624cfe5d04e63d149e1ae

    • SHA256

      3e823f563a6c968903ad715b3e9247fe9a74b198451a6fd0fd3d46f589866762

    • SHA512

      2235e6340f6e84489e8ea4f73fca633de9dba8e8058ca49ca066099f300ab0988cce4ca85540e76f24ad56ecd0969da8fd01842cebbb7ad073129a71960bf9b2

    Score
    10/10
    massloggercollectionspywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks