masslogger

General

Target

452388d551942d9adb419cf5ad3e833a73e29794beaa11f737468b63ea2cb307
Size

916KB
Sample

220521-ex4jvschhl
MD5

86ee04895d3384f34f46caace9f2ad75
SHA1

407bf45e50befadd27cab90a6c6e814725fbd9e2
SHA256

452388d551942d9adb419cf5ad3e833a73e29794beaa11f737468b63ea2cb307
SHA512

76f84a87c59adc9522f6c9bd5e17874bbe115c552b041b0cfdb15475aafb3f4b10031d58ae4652a2b02b37ea135e2160aac988130a0c0555574af07816426d6d

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\AEF946DCB4\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.5.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 7:59:54 AM MassLogger Started: 5/21/2022 7:59:43 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\CATALOGUE RMK TRADING LTD_PDF.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Extracted

Credentials

Protocol: smtp
Host:
smtp.yandex.ru
Port:
587
Username:
miraclegomez@yandex.ru
Password:
whayasaynewnew

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\F95B724EDE\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.5.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 7:59:28 AM MassLogger Started: 5/21/2022 7:59:23 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\CATALOGUE RMK TRADING LTD_PDF.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Targets

- Target
  
  CATALOGUE RMK TRADING LTD_PDF.exe
- Size
  
  856KB
- MD5
  
  de193c4b6e882040d19694c1b66c85e1
- SHA1
  
  61d4f4a219b11d083b474c3aaff59ef589e08f2f
- SHA256
  
  0407c714fca6ad87fb152afbf456a8e34a50ae5fff4b9fba36a1cb9fe1126e34
- SHA512
  
  97c413297c2cfe2a0fc63de566f7d2d3ac9531f0e5f7a2b77154d1f2aa0294f7e12331f32ee68abe55910080db68b4dea4847806faeb8bf7313331b2b2ffbb61
Score

10^/10

masslogger collection ransomware spyware stealer
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger Main Payload
- MassLogger log file
  Detects a log file produced by MassLogger.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2