masslogger

General

Target

969958fac3eeaf343eb4d790b9db320f8f70ad1d332cffec709c2b609609552c
Size

814KB
Sample

220521-neq1gsgfhk
MD5

2d1d1202e85476acf989e6e29e08e782
SHA1

c13c41351e2dd1509c4ddeec030495944cd1fad8
SHA256

969958fac3eeaf343eb4d790b9db320f8f70ad1d332cffec709c2b609609552c
SHA512

ddd4725d89f9941a5c509c61ecd603d548fc036f16a5efb0df53b2376dfdac43118412e46b400e7a181adf600987015f99886c25a09f9c5e171980f4ae6f3e61

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\79FE0CC911\Log.txt

Family

masslogger

Ransom Note

<|| v2.4.0.0 ||> User Name: Admin IP: 154.61.71.51 Location: United States Windows OS: Microsoft Windows 7 Ultimate 64bit Windows Serial Key: D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 11:37:50 AM MassLogger Started: 5/21/2022 11:37:39 AM Interval: 96 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\Peace Transit Order 1670.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: <|| WD Exclusion ||> Disabled <|| Binder ||> Disabled <|| Window Searcher ||> Disabled <|| Downloader ||> Disabled <|| Bot Killer ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> Disabled

Extracted

Path

C:\Users\Admin\AppData\Local\F95B724EDE\Log.txt

Family

masslogger

Ransom Note

<|| v2.4.0.0 ||> User Name: Admin IP: 154.61.71.50 Location: United States Windows OS: Microsoft Windows 10 Pro 64bit Windows Serial Key: W269N-WFGWX-YVC9B-4J6C9-T83GX CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 1:37:09 PM MassLogger Started: 5/21/2022 1:37:03 PM Interval: 96 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\Peace Transit Order 1670.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: <|| WD Exclusion ||> Disabled <|| Binder ||> Disabled <|| Downloader ||> Disabled <|| Window Searcher ||> Disabled <|| Bot Killer ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> Disabled

Targets

- Target
  
  Peace Transit Order 1670.exe
- Size
  
  920KB
- MD5
  
  8aa67c5024bfee5226d38305f3736291
- SHA1
  
  56eba5c41aa2a88480834f37393e397d3e6260c8
- SHA256
  
  c9787a5aeefa1606bd166b54177d9f685dd01f03632ff9f3952909193c657028
- SHA512
  
  692adfe96ca0779a79fb9207e0a5e62dbd85887a53ccb8537bb600f9a2937fe2b7bf41643646fdf04f404922d96eaa72042a9a44fd78141ecd1cf3d9d868ba52
Score

10^/10

masslogger collection ransomware spyware stealer
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger log file
  Detects a log file produced by MassLogger.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2