masslogger

General

Target

f01fa521086018767cf288a719022222f579bf5a00fd2e85089cae82fad2d798
Size

704KB
Sample

220521-pdyjlsacgl
MD5

4929e99ac6439d497ddf1917baaf7219
SHA1

00523494b9118b31ae96f54d59f8c254f3fe26d7
SHA256

f01fa521086018767cf288a719022222f579bf5a00fd2e85089cae82fad2d798
SHA512

68ee02d94da179458d5e8c35f41e10a595eabc0b0cd51bdf3e2d97dc9e37ee2216110fe9db3e62eac0de9a84f5c59e8931fbf403e4eeae56fead79deeac379ec

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\3B8E3C2477\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.4.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 2:26:36 PM MassLogger Started: 5/21/2022 2:26:25 PM Interval: 1 hour MassLogger Process: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Targets

- Target
  
  SwiftSDM.scan.pdf..exe
- Size
  
  745KB
- MD5
  
  b881533b7b297c09802c0b74adbd2936
- SHA1
  
  23e8bcb9a029df6f8ee460eec6ac600459d6eed3
- SHA256
  
  0ceca38c78e5862c0d87d4c0dfacfb25fef8310e502415721c35331f1315cc04
- SHA512
  
  caa530f0fff257b66b2ae107a8ffdd2df910a24c640559965491e2281a99949aae0761a537ee7bd349b4154f03f27d991435270b09cdb97df0d02e29e8ac4497
Score

10^/10

masslogger persistence ransomware spyware stealer
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger Main Payload
- MassLogger log file
  Detects a log file produced by MassLogger.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2