masslogger

General

Target

90b541c5d2b2738109fe53bef96ac20d79f45997467fa7417c74bef812850b8c
Size

1.4MB
Sample

220521-xk5khacaa2
MD5

42ea996963b40fa149c967edb3def794
SHA1

3512df1624733f01b383d06a8c723ecd47fe2e1e
SHA256

90b541c5d2b2738109fe53bef96ac20d79f45997467fa7417c74bef812850b8c
SHA512

4bb335df18f75d13a7a28f3e2366d5b1e2ceebad6c877701d95ebbcfa18e425a2b882d9b9681f5adf6a2dc9509bfb347ef84c57203378ca62ba855c44d047b95

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\AEF946DCB4\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.3.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 8:57:08 PM MassLogger Started: 5/21/2022 8:56:57 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe As Administrator: True

Extracted

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
m4cfund@yandex.com
Password:
Dmacdavid

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\2EF8342664\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.3.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 8:56:44 PM MassLogger Started: 5/21/2022 8:56:41 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe As Administrator: True

Targets

- Target
  
  Veitstar Inquiry.exe
- Size
  
  2.5MB
- MD5
  
  5c8c2fb2fbd3c20a62a107e34226e90f
- SHA1
  
  c85262bd4d832a4ef68ef1940cee8501d1cab90e
- SHA256
  
  44a169140fbd4a243478d8504cb62dd7a5d2225df55d058c4aa71dd0c0d7c480
- SHA512
  
  9912e0231369acce4cf7b63e1f2d06c76a0161bc85e13789ab02129774de8dcf6c57f30a694d8180491e7eb42112cd22c75d79587882f836255919fcde11f246
Score

10^/10

masslogger agilenet collection ransomware spyware stealer
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger log file
  Detects a log file produced by MassLogger.
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2