Overview

overview

10

Static

static

0461cd6c0d...49.exe

windows7_x64

10

0461cd6c0d...49.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0461cd6c0d0a0c2b2987598f900c28decc01174af345897823a10118d7689249

  • Size

    2.2MB

  • Sample

    220524-z3wfnagdd8

  • MD5

    bc5b6c3533eb2b20b6c46fcb67d0ae8f

  • SHA1

    b10c0d14b9d59390b92dc5779d1c152714e56191

  • SHA256

    0461cd6c0d0a0c2b2987598f900c28decc01174af345897823a10118d7689249

  • SHA512

    60b4ed338d52b932d2741eb96fe10bf5c0d21f8082dc37e03c1622e0349eea331cf6bbb6215567ca0103cbcafe20d62b72f9e912f85b302b269bb7515a45aa5e

Score
10/10
massloggercollectionspywarestealerupx

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.wolterfan.com
  • Port:
    587
  • Username:
    marketing2@wolterfan.com
  • Password:
    @Mar123

Targets

    • Target

      0461cd6c0d0a0c2b2987598f900c28decc01174af345897823a10118d7689249

    • Size

      2.2MB

    • MD5

      bc5b6c3533eb2b20b6c46fcb67d0ae8f

    • SHA1

      b10c0d14b9d59390b92dc5779d1c152714e56191

    • SHA256

      0461cd6c0d0a0c2b2987598f900c28decc01174af345897823a10118d7689249

    • SHA512

      60b4ed338d52b932d2741eb96fe10bf5c0d21f8082dc37e03c1622e0349eea331cf6bbb6215567ca0103cbcafe20d62b72f9e912f85b302b269bb7515a45aa5e

    Score
    10/10
    massloggercollectionspywarestealerupx

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger log file

      Detects a log file produced by MassLogger.

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks