masslogger

General

Target

6d64b4e9f5d0ce23f886c24e546fa03e0f4022835e5c98249a6d4259a5d7fef7
Size

876KB
Sample

220521-de9sgsaffk
MD5

ebbdddb9ce2dd7f05392e2d2769e6779
SHA1

beecc35eeeeecc68cc91f738648b30ef083ca9ab
SHA256

6d64b4e9f5d0ce23f886c24e546fa03e0f4022835e5c98249a6d4259a5d7fef7
SHA512

c23659928c6042479343ec240a19fd9d524e5c3a1466425ae2b21e3b28ae2e83133c74fcac2aefc86695b556963c8a80a718a7a0b29443617ec740483ac36372

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\8506BBE7FF\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.2.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.13 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 6:26:16 AM MassLogger Started: 5/21/2022 6:25:57 AM Interval: 6 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\6d64b4e9f5d0ce23f886c24e546fa03e0f4022835e5c98249a6d4259a5d7fef7.exe As Administrator: True

Extracted

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
logs2020@gtbenk-plc.com
Password:
mkoify147@@@

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\19E979543A\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.2.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.13 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 6:25:55 AM MassLogger Started: 5/21/2022 6:25:39 AM Interval: 6 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\6d64b4e9f5d0ce23f886c24e546fa03e0f4022835e5c98249a6d4259a5d7fef7.exe As Administrator: True

Targets

- Target
  
  6d64b4e9f5d0ce23f886c24e546fa03e0f4022835e5c98249a6d4259a5d7fef7
- Size
  
  876KB
- MD5
  
  ebbdddb9ce2dd7f05392e2d2769e6779
- SHA1
  
  beecc35eeeeecc68cc91f738648b30ef083ca9ab
- SHA256
  
  6d64b4e9f5d0ce23f886c24e546fa03e0f4022835e5c98249a6d4259a5d7fef7
- SHA512
  
  c23659928c6042479343ec240a19fd9d524e5c3a1466425ae2b21e3b28ae2e83133c74fcac2aefc86695b556963c8a80a718a7a0b29443617ec740483ac36372
Score

10^/10

masslogger collection coreentity ransomware rezer0 spyware stealer
- CoreEntity .NET Packer
  A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
  coreentity
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger Main Payload
- MassLogger log file
  Detects a log file produced by MassLogger.
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2