masslogger

General

Target

cd5a28f5ca66e96380d357bb748e2eeaa9390106cc64837d5553944d5d068c86
Size

886KB
Sample

220521-n9dcwaaafj
MD5

4cbe2f54d364645a83b194951eb47b6f
SHA1

c7d1e396a754b97caa1838c6f31f45f92edb3f4d
SHA256

cd5a28f5ca66e96380d357bb748e2eeaa9390106cc64837d5553944d5d068c86
SHA512

789e945fdf0f48e9db6fefcd2f56a3acba5f365b98484bbdc95d020299dae1d0cea79632ba618d910db6e9eec9c39aa7681b1b07a230b57e15cc700da02cebb9

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
andersonchuks@yandex.com
Password:
qwerty123@@

Targets

- Target
  
  shipping documents.exe
- Size
  
  920KB
- MD5
  
  c123ec3aef41473c9a1eed6b341b2832
- SHA1
  
  9e5d79fbc191913b6190d09c943723135135f54b
- SHA256
  
  11898f39e67e27f6ff6b7b2065d92cc7c8dae4c020b8c0a85f6af1761e54c1fc
- SHA512
  
  32b7bff431f78044a79592900190d3d6c3ea2ca5dc83f1696a4fe9b3e88fe2123d9ab9055d6ea718c04aa8e903eaf2ff321525febe99b21e6e3a2aeedb31205b
Score

10^/10

masslogger collection coreentity rezer0 spyware stealer
- CoreEntity .NET Packer
  A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
  coreentity
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger Main Payload
- MassLogger log file
  Detects a log file produced by MassLogger.
- CoreCCC Packer
  Detects CoreCCC packer used to load .NET malware.
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2