masslogger

General

Target

bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be
Size

923KB
Sample

220524-ve1m9aabe8
MD5

22a544c96d4373c1bb70ab10616d6dfc
SHA1

24d6958135e39dd8ac536ebc6385f200566cfa11
SHA256

bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be
SHA512

9530ec552ef5380087161157530f5d9b5c8640d656e962e733b7c94cfa646e1f861cccbcb6a4cd583801e5d4a6b258a2a931b28f07edeb353b6eb8ba223947f2

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\79FE0CC911\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.4.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/24/2022 5:30:26 PM MassLogger Started: 5/24/2022 5:30:19 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Targets

- Target
  
  bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be
- Size
  
  923KB
- MD5
  
  22a544c96d4373c1bb70ab10616d6dfc
- SHA1
  
  24d6958135e39dd8ac536ebc6385f200566cfa11
- SHA256
  
  bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be
- SHA512
  
  9530ec552ef5380087161157530f5d9b5c8640d656e962e733b7c94cfa646e1f861cccbcb6a4cd583801e5d4a6b258a2a931b28f07edeb353b6eb8ba223947f2
Score

10^/10

masslogger coreentity ransomware rezer0 spyware stealer
- CoreEntity .NET Packer
  A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
  coreentity
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger log file
  Detects a log file produced by MassLogger.
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

CoreEntity .NET Packer

MassLogger log file

ReZer0 packer

Checks computer location settings

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2