masslogger

General

Target

2978b788d747c1dfe75e273d6fdff0dab0ac85e589a8f953786fa23d899276c5
Size

1014KB
Sample

220521-dtpqvsbcfr
MD5

6dfe3c728249f76e9f7cde258a005ce1
SHA1

ba244f3771b75379869805f80a0f2a2a641a9560
SHA256

2978b788d747c1dfe75e273d6fdff0dab0ac85e589a8f953786fa23d899276c5
SHA512

79835795b46127b0febebac2cedb732fa1f86092b6543d0ec88504a0e955d62e215492f97d6e66e618ae8e955e4fc934bd871fcfd43f7681e5c566c6c6c6a598

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\8506BBE7FF\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.6.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.13 Location: United States Windows OS: Microsoft Windows 7 Ultimate 64bit Windows Serial Key: D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 6:53:35 AM MassLogger Started: 5/21/2022 6:53:17 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\Circulator 27643.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Extracted

Credentials

Protocol: smtp
Host:
mail.itdone.cz
Port:
587
Username:
testovaci@itdone.cz
Password:
viObavejMa

Targets

- Target
  
  Circulator 27643.exe
- Size
  
  953KB
- MD5
  
  048b39faaf884a5eae0a72e2325a6fb0
- SHA1
  
  fcade786c16cd0af8b5699e57b54a30a7ce08f09
- SHA256
  
  7f2a8610931a1f5ff9793dcb854ca01aaa6410fb5b4dc287753c558f1b60eee1
- SHA512
  
  b360b817f6df4ac7303df3c8ee4657805780b9660823bbc1cd78ce24df8e6af48d914e3aa06215064f217d903311f6ab52e9cd80e1b2fb83d02ef0439d12d464
Score

10^/10

masslogger collection ransomware rezer0 spyware stealer
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger Main Payload
- MassLogger log file
  Detects a log file produced by MassLogger.
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2