Overview

overview

10

Static

static

SwiftBNF.s...f..exe

windows7_x64

10

SwiftBNF.s...f..exe

windows10-2004_x64

6

Sharing

Copy URL Twitter E-mail

General

  • Target
    2a6edd2356faca41db31e6f58e423fcf9b82272af8cf8d15dfe542585fc4c710
  • Size 695KB
  • Sample220521-pybkksbdfl
  • SHA256 2a6edd2356faca41db31e6f58e423fcf9b82272af8cf8d15dfe542585fc4c710
  • MD5 SHA1 SHA512
Score
10/10
massloggerpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Users\Admin\AppData\Local\Temp\79FE0CC911\Log.txt

  • masslogger

Ransom Note
  • ################################################################# MassLogger v1.3.4.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 12:50:36 PM MassLogger Started: 5/21/2022 12:50:25 PM Interval: 1 hour MassLogger Process: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Targets

    • Target
      SwiftBNF.scan.pdf..exe
    • Size 732KB
    • SHA256 59ab0c3f8318f555ee1316fa382e9947c79e4ea03f321ebd282ed08012b8139a
    • MD5 SHA1 SHA512
    Score
    10/10
    massloggerpersistenceransomwarespywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main Payload

    • MassLogger log file

      Detects a log file produced by MassLogger.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks