General
-
Target
b3efc3524b8db0b1f4d10f9109c1da1730fa3682569b001f69bfb55bf46a6bf0
-
Size
599KB
-
Sample
220524-zw8seagbd8
-
MD5
1a020afffcdea3a899dd138a0560a69a
-
SHA1
87cbf8d4451e288ac05d4ef01593bab55fa39436
-
SHA256
b3efc3524b8db0b1f4d10f9109c1da1730fa3682569b001f69bfb55bf46a6bf0
-
SHA512
4be8ec734910be40cf2ec180b48adcb80eba86a4e90809cc027d019a6bcc709fe64628d09981c6d54564610daaac4f9013cc22687abc73787deb21ab4a41791e
Static task
static1
Behavioral task
behavioral1
Sample
KREG New Order - AM2 PO 90664 (Panda Construction).exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
KREG New Order - AM2 PO 90664 (Panda Construction).exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\Users\Admin\AppData\Local\3B8E3C2477\Log.txt
masslogger
Extracted
C:\Users\Admin\AppData\Local\0F48153F20\Log.txt
masslogger
Targets
-
-
Target
KREG New Order - AM2 PO 90664 (Panda Construction).exe
-
Size
728KB
-
MD5
b10ed3e241e4f0ff758cf395a8204c77
-
SHA1
2d71d1d5217977794946378bf6c6017b3775fd6a
-
SHA256
efcb7e7f2d7fc92675b9d189448047612847392bfc10f9324e04a4c6c9c203bd
-
SHA512
e5cfb2db8d248c48e511eca778574200450a5ca656b453924e69f3a9f21078f6c75c132bbdc43f3709ce563d3a871f43e97bf9e310acb6fe8df826db86add7a4
Score10/10-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger log file
Detects a log file produced by MassLogger.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-