masslogger

General

Target

0971cbc70ca0abf88a7059f0eb904112d64db2355890bc956244b44371534a28
Size

845KB
Sample

220521-ppqm5sfgb9
MD5

88ee58092059ef41e919604e746f4be1
SHA1

382ed1e911833923c5911f6fb8f67eb2ea8fc635
SHA256

0971cbc70ca0abf88a7059f0eb904112d64db2355890bc956244b44371534a28
SHA512

91ce0816acd3415f1d67ac599bed9427d0b2a555b1ec73eac5131e5e3d3ea07a09372627cbefbb4f128b25cd3172bfbfe67786ed0e501175cfd3b7943ce09c13

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\3B8E3C2477\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.5.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 3:12:06 PM MassLogger Started: 5/21/2022 3:11:39 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\RFQ.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Extracted

Credentials

Protocol: smtp
Host:
mail.ucfblr.com
Port:
587
Username:
narasimha.murthy@ucfblr.com
Password:
Nam@123s#

Targets

- Target
  
  RFQ.exe
- Size
  
  875KB
- MD5
  
  d09e24ff3e15d721e4a7feac4e9b1ef5
- SHA1
  
  12017612e0361f56a2d1fd593a3b54895a34f4a9
- SHA256
  
  776a4ff176f431da77a945cf047746d71aa1b629c743d16a8018f883692cf7c8
- SHA512
  
  9c084b6b92a0cfb0bf7d3eef6aee45a3fd881a968b95e07b268093bb7b41d52bae883b4df012f58afe36d044fa75a6da37384e84b23166b7e6dc7ac770c43d2d
Score

10^/10

masslogger collection ransomware rezer0 spyware stealer
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger log file
  Detects a log file produced by MassLogger.
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2