masslogger

General

Target

6e8d5f2efa0d7a26b6e1adbfc706b33f6b8ff84021558465a1692da0c165a239
Size

866KB
Sample

220521-dad51saddm
MD5

196c206c1aa52b1b33f65725f1f0abb1
SHA1

5f99a95721a0fd363355133b4df630de1b89210f
SHA256

6e8d5f2efa0d7a26b6e1adbfc706b33f6b8ff84021558465a1692da0c165a239
SHA512

446850849bc68de15dc3cff21c2c1a9784bc4a75fdf044f18735fabd433df363fc3530f7757e89057a569c187f1ba3a9f68bca07a19700b6e55ca903643ffeb5

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\3B8E3C2477\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.5.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 6:15:18 AM MassLogger Started: 5/21/2022 6:15:07 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\scan00465.pdf.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\8236ADF044\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.5.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 6:15:09 AM MassLogger Started: 5/21/2022 6:15:06 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\scan00465.pdf.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Extracted

Credentials

Protocol: smtp
Host:
mail.saritatravels.com
Port:
587
Username:
[email protected]
Password:
sumits%$321

Targets

- Target
  
  scan00465.pdf.exe
- Size
  
  1.1MB
- MD5
  
  6689c734a79172a09227598c7befc88c
- SHA1
  
  245ff8f832b627de99615d7b6396883c4abfbf13
- SHA256
  
  1583e4f9d42db06490a42d0a0fe911a0e4d390ad07b9b8f2d8245e675dff0a33
- SHA512
  
  7bbea317fb7c3c593390b12b9161d2baca584bad32ef7bdc754219b3c04b6ca08c2e82bf55907b9a4e9d026e55180b977430bc791130c05ef789d3f55125d0d2
Score

10^/10

masslogger ransomware rezer0 spyware stealer collection
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger log file
  Detects a log file produced by MassLogger.
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2