masslogger

General

Target

f9abeb7ba32ac4b84d855503d607cfe2fc79f147512db0871a262d53c560c5c1
Size

790KB
Sample

220521-pdqtrsfba9
MD5

bb5d4969a5156c1977998cce74f4624e
SHA1

8866b139ff9512debf0abf4cc50ec55cda88f265
SHA256

f9abeb7ba32ac4b84d855503d607cfe2fc79f147512db0871a262d53c560c5c1
SHA512

10425d190bf7d9165190010fa230e693eb3b7cee530112dde0108e445746b579e67f81e704ac3fcda74a6767b8a62545657db178f41a60d19520ce1f6a786684

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\79FE0CC911\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.5.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 1:04:54 PM MassLogger Started: 5/21/2022 1:04:43 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\catalogues lists.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\F95B724EDE\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.5.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 3:04:24 PM MassLogger Started: 5/21/2022 3:03:55 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\catalogues lists.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Targets

- Target
  
  catalogues lists.exe
- Size
  
  847KB
- MD5
  
  f6d7d69e4daa79e5a61cee1dd563f372
- SHA1
  
  6fa906729eafee56d8c077215881cbb0f7a8ad36
- SHA256
  
  1a1e5e11d4fc8b5b0b1b8d7ba56879a75c9079aa63c613d2f266a1b84bc15cfd
- SHA512
  
  28a9ccfa6b1d20ccae445d41989c2115e6a2bb5f16b828fc4dc22f588f27c826edec7a590243db2e38d0de9956469604bb58c97f773c7310bffc49f4408aa380
Score

10^/10

masslogger collection evasion ransomware spyware stealer
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger log file
  Detects a log file produced by MassLogger.
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2