masslogger

General

Target

6c5210755b655eb982c7d572de94e5ef9d685ec236e629ef03eb99bbcabfcdaf
Size

650KB
Sample

220521-da5mzafch6
MD5

e5591b0e2f20cae1b61a7fa108f2e4b5
SHA1

750de3296b6bdcb5e8129f4ee4b1858e43553c90
SHA256

6c5210755b655eb982c7d572de94e5ef9d685ec236e629ef03eb99bbcabfcdaf
SHA512

dcc27cb1c1c7f05aa48a45c92e2769506ab5cb18e091abddb3a4490dfc37a1cbb18436fd19727359d156658036e38a1d1b07cc3b8976008f694ee1aad2e773d1

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\8506BBE7FF\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v2.0.0.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.13 Location: United States Windows OS: Microsoft Windows 7 Ultimate 64bit Windows Serial Key: D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 6:12:46 AM MassLogger Started: 5/21/2022 6:12:35 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\RFQ.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Targets

- Target
  
  RFQ.exe
- Size
  
  842KB
- MD5
  
  43bf47ce9c3b94e284d4b1127ae23316
- SHA1
  
  ecd3faede2a34fee58c8b84e297abf217e9b4b4c
- SHA256
  
  db18483e4256dc8f3362b52e3474260eeee4a7e7af43c8126200237e5a8804db
- SHA512
  
  dfa81578090f56788c7b76bbca564a2c3cfb2e49c6ee83a92a46adc5a57a802950c18368ae1a4df68d4e0b6e3342b2c83d0ebb1b73b4edd93f347d309a891d72
Score

10^/10

masslogger collection ransomware spyware stealer
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger log file
  Detects a log file produced by MassLogger.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2