masslogger | 20e92c2bf75c473b745617932f8dc0f8051bfc2f91bb938b2cc1cd808ebbc675

General

Target

20e92c2bf75c473b745617932f8dc0f8051bfc2f91bb938b2cc1cd808ebbc675.exe
Size

550KB
MD5

5a519c2a100403b31cbfa3a720dda1b8
SHA1

05bfc6b320d9b72e94aaa92279b80fa60b0fc873
SHA256

20e92c2bf75c473b745617932f8dc0f8051bfc2f91bb938b2cc1cd808ebbc675
SHA512

6c5d0e35750a998985652178efaf4dbea4f368132468a432002bed3493403d9d92b0fe37d3d8946dfb68d9452a873fc40cec818a1cce3959fd582ece7bdbaade

Score

10^/10

masslogger vidar discovery spyware stealer suricata

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar log file 1 IoCs
Detects a log file produced by Vidar.

Processes:

yara_rule

vidar_log_file
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 ip-api.com

yara_rule
vidar_log_file

flow	ioc
6	ip-api.com

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

20e92c2bf75c473b745617932f8dc0f8051bfc2f91bb938b2cc1cd808ebbc675.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	20e92c2bf75c473b745617932f8dc0f8051bfc2f91bb938b2cc1cd808ebbc675.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	20e92c2bf75c473b745617932f8dc0f8051bfc2f91bb938b2cc1cd808ebbc675.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

20e92c2bf75c473b745617932f8dc0f8051bfc2f91bb938b2cc1cd808ebbc675.exe

pid	process
2788	20e92c2bf75c473b745617932f8dc0f8051bfc2f91bb938b2cc1cd808ebbc675.exe
2788	20e92c2bf75c473b745617932f8dc0f8051bfc2f91bb938b2cc1cd808ebbc675.exe
2788	20e92c2bf75c473b745617932f8dc0f8051bfc2f91bb938b2cc1cd808ebbc675.exe
2788	20e92c2bf75c473b745617932f8dc0f8051bfc2f91bb938b2cc1cd808ebbc675.exe
2788	20e92c2bf75c473b745617932f8dc0f8051bfc2f91bb938b2cc1cd808ebbc675.exe
2788	20e92c2bf75c473b745617932f8dc0f8051bfc2f91bb938b2cc1cd808ebbc675.exe
2788	20e92c2bf75c473b745617932f8dc0f8051bfc2f91bb938b2cc1cd808ebbc675.exe
2788	20e92c2bf75c473b745617932f8dc0f8051bfc2f91bb938b2cc1cd808ebbc675.exe

C:\Users\Admin\AppData\Local\Temp\20e92c2bf75c473b745617932f8dc0f8051bfc2f91bb938b2cc1cd808ebbc675.exe
"C:\Users\Admin\AppData\Local\Temp\20e92c2bf75c473b745617932f8dc0f8051bfc2f91bb938b2cc1cd808ebbc675.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2788