masslogger

General

Target

b8c1012ee15a746b67962168115e165e638c337d2fa305741b57752218827d7e
Size

828KB
Sample

220521-nck2fsddh6
MD5

5b9d19e3b977a867e51e076ad3536048
SHA1

ef5faec831bbd8f234f295985499eacc15e43f23
SHA256

b8c1012ee15a746b67962168115e165e638c337d2fa305741b57752218827d7e
SHA512

7d9baa7a26349f18044dc4e4e8f6415618a086856628570e70697c1e7ff75a506434aed06b4dec74f0cf6a9bdc5a382dcc15f107e0f4615e6b8ad19f61d12a37

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\F293CD6622\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.3.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 1:35:03 PM MassLogger Started: 5/21/2022 1:34:52 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe As Administrator: True

Extracted

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
m4cfund@yandex.com
Password:
Dmacdavid

Targets

- Target
  
  RFQ #0605176.exe
- Size
  
  1.4MB
- MD5
  
  c711fc1c2e67bfa34d1117e526365033
- SHA1
  
  842f0492db652ad8da1553b98240a5dd0a439de2
- SHA256
  
  3027dc21e325fddbc9e6cd21b0491f3270190f219776de4971e510c4490d3c25
- SHA512
  
  95e1628a6249fe7a0059f699c4e61a6f132c67c76c669056ecb37d36afc11e88d3f1cddcc5c7d72763c3f32f137c4b22c21231197c9078229265a04ed6d9db8b
Score

10^/10

masslogger collection ransomware spyware stealer
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger log file
  Detects a log file produced by MassLogger.
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2