General
Target

44fee899ebeec1324a812d88a40d9f68824baec113e7520385d1f6a658e2ec84

Size

831KB

Sample

220521-pl8dsaagdj

Score
10/10
MD5

10cac77805e52a908c1d92cd2a7f9f72

SHA1

72205560aaa7aa3787ca5e6a2b9614b735119147

SHA256

44fee899ebeec1324a812d88a40d9f68824baec113e7520385d1f6a658e2ec84

SHA512

fa93a0b9c1df8163ef7ad850e5593e7c5c95ab3c35989a4b579882da46b0afac161f4ec29c36b0e00eca3d0c88facfbcf61275b6e5fc430bb473e3cece6e0b09

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\3B8E3C2477\Log.txt

Family

masslogger

Ransom Note
################################################################# MassLogger v1.3.2.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 2:37:34 PM MassLogger Started: 5/21/2022 2:37:23 PM Interval: 6 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\TT COPY osdnsufsuifhsifudsujdfs,,,,.exe As Administrator: True

Extracted

Credentials

Protocol: smtp

Host: us2.smtp.mailhostbox.com

Port: 587

Username: logs2020@gtbenk-plc.com

Password: mkoify147@@@

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\F95B724EDE\Log.txt

Family

masslogger

Ransom Note
################################################################# MassLogger v1.3.2.0 ################################################################# ### Logger Details ### User Name: Admin IP: 127.0.0.1 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 2:37:11 PM MassLogger Started: 5/21/2022 2:36:23 PM Interval: 6 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\TT COPY osdnsufsuifhsifudsujdfs,,,,.exe As Administrator: True
Targets
Target

TT COPY osdnsufsuifhsifudsujdfs,,,,.exe

MD5

6d37e918a7aeec2a9ebde6092dc75d72

Filesize

922KB

Score
10/10
SHA1

ee76d5b79861aaacaae30ee7cea264324f26752e

SHA256

45970f8f1497ab648eb24a71690d876dc6e18ed42e95da854252ec79b7939ab6

SHA512

b6b1689854c52283d1debc2380b081f068684be8ab181487e29a22bb5da045aafebae3129c7cab7513a705368493f4b6d10a407548a19b5dd6b6e4100000689c

Tags

Signatures

  • CoreEntity .NET Packer

    Description

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

    Tags

  • MassLogger

    Description

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    Tags

  • MassLogger Main Payload

  • MassLogger log file

    Description

    Detects a log file produced by MassLogger.

  • ReZer0 packer

    Description

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    Tags

  • Checks computer location settings

    Description

    Looks up country code configured in the registry, likely geofence.

    TTPs

    Query RegistrySystem Information Discovery
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Accesses Microsoft Outlook profiles

    Tags

    TTPs

    Email Collection
  • Looks up external IP address via web service

    Description

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
      Execution
        Exfiltration
          Impact
            Initial Access
              Lateral Movement
                Persistence
                Privilege Escalation
                  Tasks

                  static1

                  Score
                  N/A

                  behavioral2

                  Score
                  10/10