masslogger

General

Target

050c2d432568b83f75b1203ecea8e2a305408bc4e296161edc1ec8f381a0241f
Size

1.4MB
Sample

220521-ppzk2sfgd4
MD5

679fbc62ed378c6d0c6dce3481d9d118
SHA1

01e6548f6769f3748eb7cfdd644975e7f0efb574
SHA256

050c2d432568b83f75b1203ecea8e2a305408bc4e296161edc1ec8f381a0241f
SHA512

9ea60588a0920c67eb2a6c53c0b0d61a63836ea1fe01b62cd6d3abd56fe1104aec472adce7e011819c3bd9bd4f4ca673c2dfb72114dd1854a74dd6cf58bceaea

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\3B8E3C2477\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.4.0 ################################################################# ### Logger Details ### User Name: Admin IP: 127.0.0.1 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 3:11:23 PM MassLogger Started: 5/21/2022 3:10:56 PM Interval: 5 hour MassLogger Process: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\2EF8342664\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.4.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 3:11:57 PM MassLogger Started: 5/21/2022 3:11:33 PM Interval: 5 hour MassLogger Process: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Targets

- Target
  
  REQUEST_.SCR
- Size
  
  858KB
- MD5
  
  ee07a20a60dd6c53958568469f4e6bec
- SHA1
  
  966cbcfcb101e2d6a70b940de20376ba2f6d7164
- SHA256
  
  8b701ead5af587161656419272dfa0fca1087ce8f5603ad1e6f70332f9a1fb04
- SHA512
  
  668c2d5a98fcca6fb18d599a17415100a2153fe06130532308012b5f4e12afbe08e6bc0f8dac249fac0f85d299800032a7971176eebf7a44ffcb74216c835bfa
Score

10^/10

masslogger ransomware rezer0 spyware stealer
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger log file
  Detects a log file produced by MassLogger.
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2