General
-
Target
4ec68b8b761b43381c19cf7457c9d0d7e0942d73c89bd4f57f91a34b4581fb78
-
Size
1.4MB
-
Sample
220521-plqhzafeg2
-
MD5
8864cfae8bf9ce394f0b1a2261e838c2
-
SHA1
591a959a3a8e2d09bd89e8fa1196cf5cdc737f16
-
SHA256
4ec68b8b761b43381c19cf7457c9d0d7e0942d73c89bd4f57f91a34b4581fb78
-
SHA512
c8dccfd191ae11c47feb24f344c07690afcbc5daf3bea8e031eb3c9e25a960f7999657dfa4d60d305d4a37f6e4a546802f3affd959f0111a52beb3a24f3849da
Static task
static1
Behavioral task
behavioral1
Sample
DHL_MAY_.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
DHL_MAY_.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\3B8E3C2477\Log.txt
masslogger
Extracted
C:\Users\Admin\AppData\Local\Temp\F95B724EDE\Log.txt
masslogger
Extracted
Protocol: smtp- Host:
mail.kogep-k.hu - Port:
587 - Username:
dekgep@dekgep.hu - Password:
Vb^4ZJR[JffqT,F2Tb
Targets
-
-
Target
DHL_MAY_.EXE
-
Size
816KB
-
MD5
4ea547efe0fcb7dde07eb2a9c6891040
-
SHA1
f45314bf78ce40bb81df533dbd6861260a609c4f
-
SHA256
cd5eeb8026313e1bcfff3db5c1e30ff15477427f16e23e885df3b57adceac0b6
-
SHA512
77f30789b5f08bf67522228d5cc818ebd12b0f681bca1d7f4f3b3694deb67c6528e8390b435fca0cadcb722aa789bb0e966e6c4f2434382c3660192d54db2025
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload
-
MassLogger log file
Detects a log file produced by MassLogger.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-