Description
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
General
Target
Size
Sample
4ec68b8b761b43381c19cf7457c9d0d7e0942d73c89bd4f57f91a34b4581fb78
1MB
220521-plqhzafeg2
Score
10/10
MD5
SHA1
SHA256
SHA512
8864cfae8bf9ce394f0b1a2261e838c2
591a959a3a8e2d09bd89e8fa1196cf5cdc737f16
4ec68b8b761b43381c19cf7457c9d0d7e0942d73c89bd4f57f91a34b4581fb78
c8dccfd191ae11c47feb24f344c07690afcbc5daf3bea8e031eb3c9e25a960f7999657dfa4d60d305d4a37f6e4a546802f3affd959f0111a52beb3a24f3849da
Malware Config
Extracted
| Path | C:\Users\Admin\AppData\Local\Temp\3B8E3C2477\Log.txt |
| Family | masslogger |
| Ransom Note |
#################################################################
MassLogger v1.3.4.0
#################################################################
### Logger Details ###
User Name: Admin
IP: 127.0.0.1
Location: United States
OS: Microsoft Windows 7 Ultimate 64bit
CPU: Intel Core Processor (Broadwell)
GPU: Standard VGA Graphics Adapter
AV: NA
Screen Resolution: 1280x720
Current Time: 5/21/2022 3:08:47 PM
MassLogger Started: 5/21/2022 3:08:04 PM
Interval: 96 hour
MassLogger Process: C:\Users\Admin\AppData\Local\Temp\DHL_MAY_.exe
MassLogger Melt: false
MassLogger Exit after delivery: false
As Administrator: True
Processes:
|
Extracted
| Path | C:\Users\Admin\AppData\Local\Temp\F95B724EDE\Log.txt |
| Family | masslogger |
| Ransom Note |
#################################################################
MassLogger v1.3.4.0
#################################################################
### Logger Details ###
User Name: Admin
IP: 154.61.71.50
Location: United States
OS: Microsoft Windows 10 Pro64bit
CPU: Intel Core Processor (Broadwell)
GPU: Microsoft Basic Display Adapter
AV: NA
Screen Resolution: 1280x720
Current Time: 5/21/2022 3:07:40 PM
MassLogger Started: 5/21/2022 3:07:37 PM
Interval: 96 hour
MassLogger Process: C:\Users\Admin\AppData\Local\Temp\DHL_MAY_.exe
MassLogger Melt: false
MassLogger Exit after delivery: false
As Administrator: True
Processes:
|
Extracted
| Credentials |
Protocol: smtp Host: mail.kogep-k.hu Port: 587 Username: dekgep@dekgep.hu Password: Vb^4ZJR[JffqT,F2Tb |
Targets
Target
MD5
Filesize
DHL_MAY_.EXE
4ea547efe0fcb7dde07eb2a9c6891040
816KB
Score
10/10
SHA1
SHA256
SHA512
f45314bf78ce40bb81df533dbd6861260a609c4f
cd5eeb8026313e1bcfff3db5c1e30ff15477427f16e23e885df3b57adceac0b6
77f30789b5f08bf67522228d5cc818ebd12b0f681bca1d7f4f3b3694deb67c6528e8390b435fca0cadcb722aa789bb0e966e6c4f2434382c3660192d54db2025
Tags
Signatures
-
MassLogger
-
MassLogger Main Payload
-
MassLogger log file
Description
Detects a log file produced by MassLogger.
-
ReZer0 packer
Description
Detects ReZer0, a packer with multiple versions used in various campaigns.
Tags
-
Checks computer location settings
Description
Looks up country code configured in the registry, likely geofence.
TTPs
-
Reads user/profile data of web browsers
Description
Infostealers often target stored browser data, which can include saved credentials etc.
Tags
TTPs
-
Accesses Microsoft Outlook profiles
Tags
TTPs
-
Looks up external IP address via web service
Description
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks
static1
Score
N/A
behavioral1
Score
10/10
behavioral2
Score
10/10