masslogger

General

Target

d8f1ff7249279c3a492eea283f2d88e32135e8683338b5d416e58a5c32554cc7
Size

790KB
Sample

220521-pr6r5sfhe6
MD5

8176a27a6c8ef7232df4b90267427fa6
SHA1

c90ae7b2bf85b4e525053b2abaa3ece27d7e73a7
SHA256

d8f1ff7249279c3a492eea283f2d88e32135e8683338b5d416e58a5c32554cc7
SHA512

638153b3573f2d020f2e3df50f309d3855f71e380afec817186a1a06e920192ab4162a9f1a037098c113642dbe989117f9bb97ae6022727e106563d359860065

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\3B8E3C2477\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.7.1 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States Windows OS: Microsoft Windows 7 Ultimate 64bit Windows Serial Key: D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 3:13:37 PM MassLogger Started: 5/21/2022 3:13:26 PM Interval: 9 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\Request for new order.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\0F48153F20\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.7.1 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States Windows OS: Microsoft Windows 10 Pro64bit Windows Serial Key: W269N-WFGWX-YVC9B-4J6C9-T83GX CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 1:13:59 PM MassLogger Started: 5/21/2022 1:13:56 PM Interval: 9 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\Request for new order.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Targets

- Target
  
  Request for new order.exe
- Size
  
  875KB
- MD5
  
  f6e60d4e007049b18de4fb87c38927c3
- SHA1
  
  bba2fcd204840b1235dea163bbfeae3a59e3b763
- SHA256
  
  495fdf3a95e1f56f9ec94bfdcdafe87a41be371947f24853c18cc98b24a6a281
- SHA512
  
  a46e7a014a3dd577a5e9d7976845185c1f45c6c321bf8cd3c364576afbdccbe0fca7b0057f63e13416c81a60a0e63bce9c2e4ce5b26801cb179a4e6a6c62b5c3
Score

10^/10

masslogger collection evasion ransomware spyware stealer
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger Main Payload
- MassLogger log file
  Detects a log file produced by MassLogger.
- Modifies visibility of file extensions in Explorer
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2