Overview

overview

10

Static

static

SecuriteIn...59.exe

windows7_x64

10

SecuriteIn...59.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.IL.Trojan.MSILZilla.16636.8959.1070

  • Size

    825KB

  • Sample

    220615-3vkkzaghb6

  • MD5

    8b98184196c9dd4666b78611987806ac

  • SHA1

    389aec94899bbd920acf35422bb856c473c755a5

  • SHA256

    05e3a40f74192a66cd31fc9b80043e0568e55759b24a7e041448b7061daf3b93

  • SHA512

    f64d9e8128f508327ea804b72b7d26bac0b0d4eaebbf53bf14673580ebb014d2c80142aecfb034a0383d04326478f24711c5ce90116219edcf181e612fdcc762

Score
10/10
massloggercollectionspywarestealer

Malware Config

Targets

    • Target

      SecuriteInfo.com.IL.Trojan.MSILZilla.16636.8959.1070

    • Size

      825KB

    • MD5

      8b98184196c9dd4666b78611987806ac

    • SHA1

      389aec94899bbd920acf35422bb856c473c755a5

    • SHA256

      05e3a40f74192a66cd31fc9b80043e0568e55759b24a7e041448b7061daf3b93

    • SHA512

      f64d9e8128f508327ea804b72b7d26bac0b0d4eaebbf53bf14673580ebb014d2c80142aecfb034a0383d04326478f24711c5ce90116219edcf181e612fdcc762

    Score
    10/10
    massloggercollectionspywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks