Overview

overview

10

Static

static

payment.exe

windows7_x64

10

payment.exe

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    70e44ff219518aa4feb6f11123dc4bf44fc62ad592948d2161bb10af43f97fc5

  • Size

    765KB

  • Sample

    220521-n6cbeahham

  • MD5

    5d997891ba20bf9c5b6c60245bcebb72

  • SHA1

    aac50ddab09f49cff1dedd7b0991ffb21b360503

  • SHA256

    70e44ff219518aa4feb6f11123dc4bf44fc62ad592948d2161bb10af43f97fc5

  • SHA512

    a7cdb7eaf90ea7fd8258294f0d73df7f037620f354b04bd8ab2da08024a0708c07846d960244e332c5a17799b1be6d17046f71781aff1d444aa6608d60614a81

Score
10/10
massloggercollectionspywarestealer

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    gdemaiterr@gmail.com
  • Password:
    godswill25

Targets

    • Target

      payment.exe

    • Size

      824KB

    • MD5

      4da9b1c872a6f439f021f1de649fef0b

    • SHA1

      99e749fb6f278bd3a11aef9061231a60d4d5076e

    • SHA256

      22affc52b0adbdbe156a2f9033829ff188ed56e472db2b545a1c8913641894fe

    • SHA512

      eb8a7f59731316064dcadee08d289d129c2a88d0763709a1f96456308db1487c1566f0a33bcd4c6aac1021363e7b949703d25e32c69eca86581607a5a1113670

    Score
    10/10
    massloggercollectionspywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main Payload

    • MassLogger log file

      Detects a log file produced by MassLogger.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks