General
Target

4ec68b8b761b43381c19cf7457c9d0d7e0942d73c89bd4f57f91a34b4581fb78

Size

1MB

Sample

220521-plqhzafeg2

Score
10/10
MD5

8864cfae8bf9ce394f0b1a2261e838c2

SHA1

591a959a3a8e2d09bd89e8fa1196cf5cdc737f16

SHA256

4ec68b8b761b43381c19cf7457c9d0d7e0942d73c89bd4f57f91a34b4581fb78

SHA512

c8dccfd191ae11c47feb24f344c07690afcbc5daf3bea8e031eb3c9e25a960f7999657dfa4d60d305d4a37f6e4a546802f3affd959f0111a52beb3a24f3849da

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\3B8E3C2477\Log.txt

Family

masslogger

Ransom Note
################################################################# MassLogger v1.3.4.0 ################################################################# ### Logger Details ### User Name: Admin IP: 127.0.0.1 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 3:08:47 PM MassLogger Started: 5/21/2022 3:08:04 PM Interval: 96 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\DHL_MAY_.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\F95B724EDE\Log.txt

Family

masslogger

Ransom Note
################################################################# MassLogger v1.3.4.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 3:07:40 PM MassLogger Started: 5/21/2022 3:07:37 PM Interval: 96 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\DHL_MAY_.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Extracted

Credentials

Protocol: smtp

Host: mail.kogep-k.hu

Port: 587

Username: dekgep@dekgep.hu

Password: Vb^4ZJR[JffqT,F2Tb

Targets
Target

DHL_MAY_.EXE

MD5

4ea547efe0fcb7dde07eb2a9c6891040

Filesize

816KB

Score
10/10
SHA1

f45314bf78ce40bb81df533dbd6861260a609c4f

SHA256

cd5eeb8026313e1bcfff3db5c1e30ff15477427f16e23e885df3b57adceac0b6

SHA512

77f30789b5f08bf67522228d5cc818ebd12b0f681bca1d7f4f3b3694deb67c6528e8390b435fca0cadcb722aa789bb0e966e6c4f2434382c3660192d54db2025

Tags

Signatures

  • MassLogger

    Description

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    Tags

  • MassLogger Main Payload

  • MassLogger log file

    Description

    Detects a log file produced by MassLogger.

  • ReZer0 packer

    Description

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    Tags

  • Checks computer location settings

    Description

    Looks up country code configured in the registry, likely geofence.

    TTPs

    Query RegistrySystem Information Discovery
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Accesses Microsoft Outlook profiles

    Tags

    TTPs

    Email Collection
  • Looks up external IP address via web service

    Description

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
      Execution
        Exfiltration
          Impact
            Initial Access
              Lateral Movement
                Persistence
                  Privilege Escalation
                    Tasks

                    static1

                    Score
                    N/A