Description
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
General
Target
Size
Sample
9e5fa4ba917e4e478bbbd3f5c3b816e3ade490a5762254ce63d3f3629d88dd44
606KB
220521-phhnysfch2
Score
10/10
MD5
SHA1
SHA256
SHA512
cbf3469b764477093477ee784daf5f8c
1b5ccb125a18ea714c6ae1c5fab50d6fa79b5bf0
9e5fa4ba917e4e478bbbd3f5c3b816e3ade490a5762254ce63d3f3629d88dd44
79f9649e1c18c510e1f861a57fa914fcfb3086440e3a9a2029c985f216d1aa42579a558543ea503eff11e11c3b36621768b205ee398fd3a1fcbbb10919b2efa6
Malware Config
Extracted
| Path | C:\Users\Admin\AppData\Local\Temp\79FE0CC911\Log.txt |
| Family | masslogger |
| Ransom Note |
#################################################################
MassLogger v1.3.3.0
#################################################################
### Logger Details ###
User Name: Admin
IP: 154.61.71.51
Location: United States
OS: Microsoft Windows 7 Ultimate 64bit
CPU: Intel Core Processor (Broadwell)
GPU: Standard VGA Graphics Adapter
AV: NA
Screen Resolution: 1280x720
Current Time: 5/21/2022 1:07:31 PM
MassLogger Started: 5/21/2022 1:07:20 PM
Interval: 2 hour
MassLogger Process: C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
As Administrator: True
|
Extracted
| Credentials |
Protocol: smtp Host: smtp.yandex.com Port: 587 Username: m4cfund@yandex.com Password: Dmacdavid |
Extracted
| Path | C:\Users\Admin\AppData\Local\Temp\F293CD6622\Log.txt |
| Family | masslogger |
| Ransom Note |
#################################################################
MassLogger v1.3.3.0
#################################################################
### Logger Details ###
User Name: Admin
IP: 154.61.71.50
Location: United States
OS: Microsoft Windows 10 Pro64bit
CPU: Intel Core Processor (Broadwell)
GPU: Microsoft Basic Display Adapter
AV: NA
Screen Resolution: 1280x720
Current Time: 5/21/2022 3:07:35 PM
MassLogger Started: 5/21/2022 3:06:51 PM
Interval: 2 hour
MassLogger Process: C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
As Administrator: True
|
Targets
Target
MD5
Filesize
3246744-28-06.exe
a60ca849b4d2490671b6e54a97b09e87
1MB
Score
10/10
SHA1
SHA256
SHA512
8d02d04d3bbd2ad7c4aae65189d8e289adabbbe1
b51612fb244526a66524e234ccae2d57f1c98a37080fd94664626bcdcf6c4bbb
33ffd9ac6db80c40d7f3970d25149378c7cd606c603541cf4544076ad80b6aea628df1bc8466dbd0c870f322b05cb0da47668af8758581b0f7e3d0d041dfc0ed
Tags
Signatures
-
MassLogger
-
MassLogger log file
Description
Detects a log file produced by MassLogger.
-
Executes dropped EXE
-
Checks computer location settings
Description
Looks up country code configured in the registry, likely geofence.
TTPs
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Description
Infostealers often target stored browser data, which can include saved credentials etc.
Tags
TTPs
-
Accesses Microsoft Outlook profiles
Tags
TTPs
-
Looks up external IP address via web service
Description
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks
static1
Score
N/A
behavioral1
Score
10/10
behavioral2
Score
10/10