Overview

overview

10

Static

static

10

DHL_MAY_.exe

windows7_x64

10

DHL_MAY_.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cc602ef0870ed8924eab19ab738d43ef1380e021abc732fc099718a86c306d0c

  • Size

    1.9MB

  • Sample

    220521-pfhaeafbg7

  • MD5

    9dad8237553a6e8415274918614b6b7c

  • SHA1

    cb55def8b8316d1ee08c5c19a3c331439c257490

  • SHA256

    cc602ef0870ed8924eab19ab738d43ef1380e021abc732fc099718a86c306d0c

  • SHA512

    5b02888e3b9d1b365b8658ab2475f030a2c7e927fc3dd9cabddc9c1de3503fabcaefe2f87e6a1682e5df3c62926ee6ac2ebb5d44a8a31d6a82252123d2a7f9e3

Score
10/10
massloggeragilenetransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\3B8E3C2477\Log.txt

Family

masslogger

Ransom Note
################################################################# MassLogger v1.3.4.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 3:05:47 PM MassLogger Started: 5/21/2022 3:05:32 PM Interval: 96 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\DHL_MAY_.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\F95B724EDE\Log.txt

Family

masslogger

Ransom Note
################################################################# MassLogger v1.3.4.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 3:04:53 PM MassLogger Started: 5/21/2022 3:04:49 PM Interval: 96 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\DHL_MAY_.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Targets

    • Target

      DHL_MAY_.EXE

    • Size

      1.3MB

    • MD5

      0d094405e0f1c07d1af0c62c69f0feae

    • SHA1

      41ca81f1eeea2cb539d5a2b34199d25f47a8671b

    • SHA256

      a16d191db58b4a988abfb3b12098ee3301d84a81d8feba8cb537857a573c86be

    • SHA512

      0afb01e428a105f8fdc342a2e74696ef6040f25fd8777a8962bccc98d5741c7ddc46edf5fd9cf06a6a0bd555d323ee1ed06bf170e3b2eabd4d8e483ce68046cd

    Score
    10/10
    massloggeragilenetransomwarespywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main Payload

    • MassLogger log file

      Detects a log file produced by MassLogger.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks