General
-
Target
8a11b451d016d26d350ad4d913de3af9e8ffa77e945955b26e89d23951ada1e8
-
Size
798KB
-
Sample
220525-bl3xeaeac8
-
MD5
416c6c0776664f4985d665764eb28fbc
-
SHA1
26cf9f67fd3b9286d71036d2da2d207f2727fe77
-
SHA256
8a11b451d016d26d350ad4d913de3af9e8ffa77e945955b26e89d23951ada1e8
-
SHA512
1d488a73781bfe88b4320eda583762cac4bbf7eba7a6842eaca17f444ff4c31713306e66efc2e338d93282a2a9fb772a1ff7779ab9aa88bfcefcdbc58c163b0b
Static task
static1
Behavioral task
behavioral1
Sample
8a11b451d016d26d350ad4d913de3af9e8ffa77e945955b26e89d23951ada1e8.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
8a11b451d016d26d350ad4d913de3af9e8ffa77e945955b26e89d23951ada1e8.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\3B8E3C2477\Log.txt
masslogger
Targets
-
-
Target
8a11b451d016d26d350ad4d913de3af9e8ffa77e945955b26e89d23951ada1e8
-
Size
798KB
-
MD5
416c6c0776664f4985d665764eb28fbc
-
SHA1
26cf9f67fd3b9286d71036d2da2d207f2727fe77
-
SHA256
8a11b451d016d26d350ad4d913de3af9e8ffa77e945955b26e89d23951ada1e8
-
SHA512
1d488a73781bfe88b4320eda583762cac4bbf7eba7a6842eaca17f444ff4c31713306e66efc2e338d93282a2a9fb772a1ff7779ab9aa88bfcefcdbc58c163b0b
-
CoreEntity .NET Packer
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload
-
MassLogger log file
Detects a log file produced by MassLogger.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-