masslogger

General

Target

749112fd2fc84f3f5c1da92a3c8c14ff6dbacde09dd63e25a04e425ba25bab14
Size

1.0MB
Sample

220524-rj1bhaheam
MD5

95d9aabe858db996384260fb5b1f5733
SHA1

7eb8948df56ea27e21f08be892aa36936786ee79
SHA256

749112fd2fc84f3f5c1da92a3c8c14ff6dbacde09dd63e25a04e425ba25bab14
SHA512

1652ee398ef140b16e6e2e8477222579adbe6126b1a83089daf2586db54b2aff0dfcf0e2292b149477dd55dac9b85e47853b3eb893dea9b288c9fbc6aed72575

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\3B8E3C2477\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.7.1 ################################################################# ### Logger Details ### User Name: Admin IP: 127.0.0.1 Location: United States Windows OS: Microsoft Windows 7 Ultimate 64bit Windows Serial Key: D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/24/2022 4:38:29 PM MassLogger Started: 5/24/2022 4:38:13 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\749112fd2fc84f3f5c1da92a3c8c14ff6dbacde09dd63e25a04e425ba25bab14.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Targets

- Target
  
  749112fd2fc84f3f5c1da92a3c8c14ff6dbacde09dd63e25a04e425ba25bab14
- Size
  
  1.0MB
- MD5
  
  95d9aabe858db996384260fb5b1f5733
- SHA1
  
  7eb8948df56ea27e21f08be892aa36936786ee79
- SHA256
  
  749112fd2fc84f3f5c1da92a3c8c14ff6dbacde09dd63e25a04e425ba25bab14
- SHA512
  
  1652ee398ef140b16e6e2e8477222579adbe6126b1a83089daf2586db54b2aff0dfcf0e2292b149477dd55dac9b85e47853b3eb893dea9b288c9fbc6aed72575
Score

10^/10

masslogger collection ransomware spyware stealer
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger log file
  Detects a log file produced by MassLogger.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2