masslogger | 563c39350c4156354c98d94606e264583ab03712afa53f579859a6b5c45c7230

General

Target

Order 3278526429.exe
Size

838KB
MD5

01ff671b42bdd3445280155368508a36
SHA1

3ea0d6fed3ca6b576561c451bc412e9b7a7edeef
SHA256

e0cb934757cefba44fd4713fc5b5526eb461c0a55c27cb9fd31fca7690e62bc6
SHA512

d9806017b2020e2edda538a7165c2ca330201810dc06e4a432fbf6320355f5ff01693d7ceb620cced3ca8e8e723532b6b9f140f46288017d50e653b16ab5aa78

Score

10^/10

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 6 IoCs

resource	yara_rule
behavioral1/memory/1960-59-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral1/memory/1960-60-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral1/memory/1960-62-0x00000000004A304E-mapping.dmp	family_masslogger
behavioral1/memory/1960-61-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral1/memory/1960-64-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral1/memory/1960-66-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1008 set thread context of 1960	1008	Order 3278526429.exe	28

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 1960	1008	Order 3278526429.exe	28
PID 1008 wrote to memory of 1960	1008	Order 3278526429.exe	28
PID 1008 wrote to memory of 1960	1008	Order 3278526429.exe	28
PID 1008 wrote to memory of 1960	1008	Order 3278526429.exe	28
PID 1008 wrote to memory of 1960	1008	Order 3278526429.exe	28
PID 1008 wrote to memory of 1960	1008	Order 3278526429.exe	28
PID 1008 wrote to memory of 1960	1008	Order 3278526429.exe	28
PID 1008 wrote to memory of 1960	1008	Order 3278526429.exe	28
PID 1008 wrote to memory of 1960	1008	Order 3278526429.exe	28
PID 1960 wrote to memory of 1692	1960	Order 3278526429.exe	29
PID 1960 wrote to memory of 1692	1960	Order 3278526429.exe	29
PID 1960 wrote to memory of 1692	1960	Order 3278526429.exe	29
PID 1960 wrote to memory of 1692	1960	Order 3278526429.exe	29

memory/1008-54-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

Filesize
8KB

Download
memory/1008-55-0x0000000074580000-0x0000000074B2B000-memory.dmp

Filesize
5.7MB

Download
memory/1960-56-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1960-57-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1960-59-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1960-60-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1960-61-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1960-64-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1960-66-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1960-70-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download